From c7ff584094690c02cbfe422bf0825d2eb0b2cdfc Mon Sep 17 00:00:00 2001 From: Knative Automation Date: Tue, 25 Aug 2026 10:14:35 -0400 Subject: [PATCH 01/38] upgrade to latest dependencies (#4022) bumping k8s.io/apiserver 8e159d6...9e8ccaf: > 9e8ccaf Update dependencies to v0.35.8 tag > eed1f67 Merge pull request # 140558 from lalitc375/automated-cherry-pick-of-# 140419-origin-release-1.35 > 8dc4f6e Merge pull request # 141225 from liggitt/golang-deps-1-35 > ad1860f Fix linter warnings > 10557b6 Update golang.org/x deps > 8485020 Fix ObjectVal ConvertToNative for structpb and refine mutation tests bumping k8s.io/apiextensions-apiserver 226e148...198da7e: > 198da7e Update dependencies to v0.35.8 tag > 97b0154 Merge pull request # 141225 from liggitt/golang-deps-1-35 > a506cd6 Update golang.org/x deps bumping knative.dev/pkg c9015f8...d2a153a: > d2a153a Bump the k8s group with 5 updates (# 3386) bumping k8s.io/apimachinery 3e341b5...eb97e1c: > eb97e1c Merge pull request # 141225 from liggitt/golang-deps-1-35 > b3ca310 Update golang.org/x deps bumping k8s.io/api cfdecb5...b65ac35: > b65ac35 Update dependencies to v0.35.8 tag > 5066193 Merge pull request # 141225 from liggitt/golang-deps-1-35 > 215d9ba Update golang.org/x deps bumping k8s.io/client-go d2a9618...3614e2d: > 3614e2d Update dependencies to v0.35.8 tag > 7bd3cb5 Merge pull request # 141225 from liggitt/golang-deps-1-35 > 0fab4f6 Update golang.org/x deps Signed-off-by: Knative Automation --- go.mod | 12 ++++++------ go.sum | 24 ++++++++++++------------ 2 files changed, 18 insertions(+), 18 deletions(-) diff --git a/go.mod b/go.mod index 8259fac0b5..136c19ad57 100644 --- a/go.mod +++ b/go.mod @@ -65,15 +65,15 @@ require ( gopkg.in/yaml.v2 v2.4.0 gopkg.in/yaml.v3 v3.0.1 gotest.tools/v3 v3.5.2 - k8s.io/api v0.35.7 - k8s.io/apimachinery v0.35.7 - k8s.io/client-go v0.35.7 + k8s.io/api v0.35.8 + k8s.io/apimachinery v0.35.8 + k8s.io/client-go v0.35.8 k8s.io/klog/v2 v2.140.0 k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 knative.dev/client/pkg v0.0.0-20260824022027-f22c1f6498a3 knative.dev/eventing v0.50.1-0.20260824121526-ec5c1d17105c knative.dev/hack v0.0.0-20260428014158-b2a37f1b6e7b - knative.dev/pkg v0.0.0-20260820190123-c9015f8bfdea + knative.dev/pkg v0.0.0-20260825072334-d2a153acc00c knative.dev/serving v0.50.1-0.20260821122824-98e5ef90aa70 sigs.k8s.io/controller-runtime v0.23.3 sigs.k8s.io/yaml v1.6.0 @@ -315,8 +315,8 @@ require ( gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/ini.v1 v1.67.1 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect - k8s.io/apiextensions-apiserver v0.35.7 // indirect - k8s.io/apiserver v0.35.7 // indirect + k8s.io/apiextensions-apiserver v0.35.8 // indirect + k8s.io/apiserver v0.35.8 // indirect k8s.io/cli-runtime v0.34.1 // indirect k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect knative.dev/networking v0.0.0-20260821014922-17b28c62e1cb // indirect diff --git a/go.sum b/go.sum index f1f8805bea..9d733a0659 100644 --- a/go.sum +++ b/go.sum @@ -1833,26 +1833,26 @@ honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9 k8s.io/api v0.22.5/go.mod h1:mEhXyLaSD1qTOf40rRiKXkc+2iCem09rWLlFwhCEiAs= k8s.io/api v0.27.7/go.mod h1:ZNExI/Lhrs9YrLgVWx6jjHZdoWCTXfBXuFjt1X6olro= k8s.io/api v0.27.10/go.mod h1:cDmAF4GtSVRO0+5hOY/Vo3lLCQMOp6FfrXZ94/gQwC0= -k8s.io/api v0.35.7 h1:qzjBIl6HRlZ4TXvVELrWC50d30RZu/uLJFE9efpLgxk= -k8s.io/api v0.35.7/go.mod h1:rXqZY94EWBj+9wVgdVOVS46MtnAEF09khzjCR4EOqiE= +k8s.io/api v0.35.8 h1:hxpmPYdneQPKNh0cZyB09Hwd3vgXzdcJs5R3toDXsvU= +k8s.io/api v0.35.8/go.mod h1:I5gVNknFd4hfVVcMCixrenD7V38JUY78q3jtpGyC19c= k8s.io/apiextensions-apiserver v0.27.7/go.mod h1:x0p+b5a955lfPz9gaDeBy43obM12s+N9dNHK6+dUL+g= -k8s.io/apiextensions-apiserver v0.35.7 h1:0Fj7U6mSPEJKfW2GnjOF1zthG2pIpdL2mj14mUJ3E4w= -k8s.io/apiextensions-apiserver v0.35.7/go.mod h1:sh7EoBfvntnXL6GwaLMhfvlhJpGzTFHSI7AyPQ0YQ1g= +k8s.io/apiextensions-apiserver v0.35.8 h1:2lvyZ28M01/1uOPftaPXIbsOaCslzKHTEcdCjCI0VRE= +k8s.io/apiextensions-apiserver v0.35.8/go.mod h1:/ZbM1upeajFY5yHqGMKEzWTLb5Tx3kU2SkxTCtqB4Uw= k8s.io/apimachinery v0.22.5/go.mod h1:xziclGKwuuJ2RM5/rSFQSYAj0zdbci3DH8kj+WvyN0U= k8s.io/apimachinery v0.27.7/go.mod h1:jBGQgTjkw99ef6q5hv1YurDd3BqKDk9YRxmX0Ozo0i8= k8s.io/apimachinery v0.27.10/go.mod h1:IHu2ovJ60RqxyPSLmTel7KDLdOCRbpOxwtUBmwBnT/E= -k8s.io/apimachinery v0.35.7 h1:dIMi/gFnUDiASbeBqx1wqLAB8jlNo4kysncMZceV0OM= -k8s.io/apimachinery v0.35.7/go.mod h1:1I6w9iM6v//hXKgxe1g3ybZgcOaJrcYg9sQGtndFrmc= +k8s.io/apimachinery v0.35.8 h1:piOyQQgse1sGztJVfy3B8f11YpT+KwK5KkD5Jie1EK0= +k8s.io/apimachinery v0.35.8/go.mod h1:z9Vq5oR1X38pkhh0wV531iKSeqmOVjqgHdYMjvzq2+o= k8s.io/apiserver v0.27.7/go.mod h1:OrLG9RwCOerutAlo8QJW5EHzUG9Dad7k6rgcDUNSO/w= -k8s.io/apiserver v0.35.7 h1:Z9RShd9T1nSEua/j0BQcL4JTP09jZfddR/gNr9AFSO0= -k8s.io/apiserver v0.35.7/go.mod h1:zswr0siixtL3+h07x6Ec/8CUcAcLQ4yUwT6COvKoOYQ= +k8s.io/apiserver v0.35.8 h1:DuwdXkMrrNi6ovUaQk9EZhIgP7cDaWOvNP/CvrLJNfM= +k8s.io/apiserver v0.35.8/go.mod h1:97kTXpbFyeZwLcrK5hRYfc9ZfM3T7D4oYC0WXsJoXXM= k8s.io/cli-runtime v0.34.1 h1:btlgAgTrYd4sk8vJTRG6zVtqBKt9ZMDeQZo2PIzbL7M= k8s.io/cli-runtime v0.34.1/go.mod h1:aVA65c+f0MZiMUPbseU/M9l1Wo2byeaGwUuQEQVVveE= k8s.io/client-go v0.22.5/go.mod h1:cs6yf/61q2T1SdQL5Rdcjg9J1ElXSwbjSrW2vFImM4Y= k8s.io/client-go v0.27.7/go.mod h1:dZ2kqcalYp5YZ2EV12XIMc77G6PxHWOJp/kclZr4+5Q= k8s.io/client-go v0.27.10/go.mod h1:PhrjLdIJNy7L8liOPEzm6wNlMjhIRJeVbfvksTxKNqI= -k8s.io/client-go v0.35.7 h1:UWxdVZcqqCdeip50BKoIcoGryX7WfTE1oQQVolP8HJs= -k8s.io/client-go v0.35.7/go.mod h1:uksk4ZVg/i4PrgsMsludkEe7Cp6v8hJ9wvje+2Ekn+c= +k8s.io/client-go v0.35.8 h1:tIW2sirCQMiGoCSvtOYqS059CDQ5n1nrDQa+PVt4nqY= +k8s.io/client-go v0.35.8/go.mod h1:fT8dATMU8FHMq4hlOudbsxihQ1LIQfDaLNDXBnIk6OQ= k8s.io/code-generator v0.27.7/go.mod h1:w1YF/xQcTg+d9Ag+04xuRqER+q8rDnJ70ynLql8/RLA= k8s.io/component-base v0.27.7/go.mod h1:YGjlCVL1oeKvG3HSciyPHFh+LCjIEqsxz4BDR3cfHRs= k8s.io/gengo v0.0.0-20200413195148-3a45101e95ac/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0= @@ -1884,8 +1884,8 @@ knative.dev/hack v0.0.0-20260428014158-b2a37f1b6e7b h1:MvbV2F2BdI8qKrYYUhDwbUZbX knative.dev/hack v0.0.0-20260428014158-b2a37f1b6e7b/go.mod h1:L5RzHgbvam0u8QFHfzCX6MKxu/a/gIGEdaRBqNiVbl0= knative.dev/networking v0.0.0-20260821014922-17b28c62e1cb h1:ukTLqsBsPfPsvEvB7c8DsVoKpDGi4tMsHCDzL8y8ycM= knative.dev/networking v0.0.0-20260821014922-17b28c62e1cb/go.mod h1:LcjiQvD89e7hdND0fI4O4sbWt7L8fEnb+9xPi5BEa5Y= -knative.dev/pkg v0.0.0-20260820190123-c9015f8bfdea h1:vNg/ixrFn2UMDAh727Ag26G3jZAQGskbn5VOwZvKoOM= -knative.dev/pkg v0.0.0-20260820190123-c9015f8bfdea/go.mod h1:azi5R3dOIcS9Pp8+QAZR9Yp7e/eoD7rNVFIefkZr8N8= +knative.dev/pkg v0.0.0-20260825072334-d2a153acc00c h1:x99AILfR+9/dMMSXTpD5akQkCxfqreR+Py40i4pUrmA= +knative.dev/pkg v0.0.0-20260825072334-d2a153acc00c/go.mod h1:79LFLJ+XR5kxkPWy4KBBJkdTrk00t7zynpgOpP8uKrs= knative.dev/serving v0.50.1-0.20260821122824-98e5ef90aa70 h1:15SH9Ne0DBpYFNLuCnF4UQJ+MNi3WopTWmSZPNMfX40= knative.dev/serving v0.50.1-0.20260821122824-98e5ef90aa70/go.mod h1:MP+yKsx/gLczU+agah1HgRrpU6KT0SV96a7bD+v5PKo= pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk= From 26ab02470dcfacf7293bf9563a39cf1d6e8ce355 Mon Sep 17 00:00:00 2001 From: Knative Automation Date: Wed, 26 Aug 2026 23:38:17 -0400 Subject: [PATCH 02/38] upgrade to latest dependencies (#4024) bumping knative.dev/eventing ec5c1d1...973bbbc: > 973bbbc feat(delivery): add maximum backoff duration (# 9279) bumping knative.dev/serving 98e5ef9...618b0c2: > 618b0c2 upgrade to latest dependencies (# 16682) Signed-off-by: Knative Automation --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 136c19ad57..86fd9ac31e 100644 --- a/go.mod +++ b/go.mod @@ -71,10 +71,10 @@ require ( k8s.io/klog/v2 v2.140.0 k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 knative.dev/client/pkg v0.0.0-20260824022027-f22c1f6498a3 - knative.dev/eventing v0.50.1-0.20260824121526-ec5c1d17105c + knative.dev/eventing v0.50.1-0.20260826203415-973bbbc1f791 knative.dev/hack v0.0.0-20260428014158-b2a37f1b6e7b knative.dev/pkg v0.0.0-20260825072334-d2a153acc00c - knative.dev/serving v0.50.1-0.20260821122824-98e5ef90aa70 + knative.dev/serving v0.50.1-0.20260825144834-618b0c275af1 sigs.k8s.io/controller-runtime v0.23.3 sigs.k8s.io/yaml v1.6.0 ) diff --git a/go.sum b/go.sum index 9d733a0659..996597e4cc 100644 --- a/go.sum +++ b/go.sum @@ -1878,16 +1878,16 @@ k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0x k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= knative.dev/client/pkg v0.0.0-20260824022027-f22c1f6498a3 h1:yDau9zgPC4EPkkFKsXiKslX+A4u3erge5PArBXOk+0g= knative.dev/client/pkg v0.0.0-20260824022027-f22c1f6498a3/go.mod h1:uA+bOCkcmaU8gbYLQ/6GrUXD9hmfV0tsXUoYUC/d3cg= -knative.dev/eventing v0.50.1-0.20260824121526-ec5c1d17105c h1:GfZm9tjdDAuRMtPOrAM5340nj/VHiKEpkIuxHwPYkWI= -knative.dev/eventing v0.50.1-0.20260824121526-ec5c1d17105c/go.mod h1:se5U7KcgxQ/VaAIjvWnGjYqXDQhfKwfTgB+7cf2mY1A= +knative.dev/eventing v0.50.1-0.20260826203415-973bbbc1f791 h1:LBlXWXWxKbRV5mTFsmbrTp8itbTqyILFvBVozpM0KUQ= +knative.dev/eventing v0.50.1-0.20260826203415-973bbbc1f791/go.mod h1:se5U7KcgxQ/VaAIjvWnGjYqXDQhfKwfTgB+7cf2mY1A= knative.dev/hack v0.0.0-20260428014158-b2a37f1b6e7b h1:MvbV2F2BdI8qKrYYUhDwbUZbX0BAYRSIpXM2TOtTvs0= knative.dev/hack v0.0.0-20260428014158-b2a37f1b6e7b/go.mod h1:L5RzHgbvam0u8QFHfzCX6MKxu/a/gIGEdaRBqNiVbl0= knative.dev/networking v0.0.0-20260821014922-17b28c62e1cb h1:ukTLqsBsPfPsvEvB7c8DsVoKpDGi4tMsHCDzL8y8ycM= knative.dev/networking v0.0.0-20260821014922-17b28c62e1cb/go.mod h1:LcjiQvD89e7hdND0fI4O4sbWt7L8fEnb+9xPi5BEa5Y= knative.dev/pkg v0.0.0-20260825072334-d2a153acc00c h1:x99AILfR+9/dMMSXTpD5akQkCxfqreR+Py40i4pUrmA= knative.dev/pkg v0.0.0-20260825072334-d2a153acc00c/go.mod h1:79LFLJ+XR5kxkPWy4KBBJkdTrk00t7zynpgOpP8uKrs= -knative.dev/serving v0.50.1-0.20260821122824-98e5ef90aa70 h1:15SH9Ne0DBpYFNLuCnF4UQJ+MNi3WopTWmSZPNMfX40= -knative.dev/serving v0.50.1-0.20260821122824-98e5ef90aa70/go.mod h1:MP+yKsx/gLczU+agah1HgRrpU6KT0SV96a7bD+v5PKo= +knative.dev/serving v0.50.1-0.20260825144834-618b0c275af1 h1:U7ixUp+rikVPkEEsYzn/PkL8t6OSDMfAFZfVxPb7JKQ= +knative.dev/serving v0.50.1-0.20260825144834-618b0c275af1/go.mod h1:TSVJNoOBCimZFxyVSe2+8CYuNLSlkMn4RxRSZDHditE= pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk= pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04= rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8= From 2f672ce9a80305687b88073062b48e239fb5f7a7 Mon Sep 17 00:00:00 2001 From: Ankit sisodya <118156935+Ankitsinghsisodya@users.noreply.github.com> Date: Thu, 27 Aug 2026 09:54:15 +0530 Subject: [PATCH 03/38] mcp: Add logs tool to retrieve deployed Function logs (#3819) * feat(mcp): add logs tool for retrieving function logs - Introduced a new 'logs' tool to fetch recent logs from deployed functions. - Updated documentation to include usage instructions for the logs command. - Added tests to ensure correct argument handling and mutual exclusivity between path and name parameters. This enhancement allows users to diagnose function behavior by accessing logs, improving the overall usability of the MCP tools. * fix(mcp): update logs tool description and error message for mutual exclusivity - Revised the logs tool description to clarify the usage of the 'since' argument. - Updated error message in logsHandler to indicate that 'path' and 'name' are mutually exclusive, allowing for at most one instead of exactly one. These changes enhance the clarity of the tool's documentation and improve user feedback on input errors. * refactor(mcp): enhance logs tool documentation and error handling - Updated the logs tool description to clarify that it retrieves a finite snapshot of logs and does not stream them. - Revised error handling to enforce that exactly one of 'path' or 'name' must be provided, improving user feedback on input errors. - Adjusted tests to reflect changes in argument handling and output validation. These modifications improve the clarity and usability of the logs tool, ensuring users have a better understanding of its functionality and constraints. * refactor(mcp): enhance logs tool functionality and documentation - Updated the logs tool to return a finite snapshot of logs, with improved handling for large outputs by introducing a truncation mechanism. - Clarified the documentation regarding the usage of the 'namespace' parameter, ensuring it is only valid when used with 'name'. - Added tests to validate the new truncation behavior, warning messages, and error handling for invalid parameter combinations. These changes improve the usability and clarity of the logs tool, ensuring users receive accurate feedback and can effectively manage log outputs. * refactor(mcp): enhance logs tool functionality and documentation - Updated the logs tool to clarify that it returns a finite snapshot of logs, with a default of the most recent 1000 lines per pod. - Improved handling of the 'namespace' parameter, ensuring it is only valid with 'name' and does not affect 'path' mode. - Enhanced tests to validate new behaviors, including truncation of logs and bounding of warning messages. These changes improve the usability and clarity of the logs tool, ensuring users receive accurate feedback and can effectively manage log outputs. --- pkg/mcp/instructions.md | 21 +- pkg/mcp/mcp.go | 2 + pkg/mcp/tools_logs.go | 186 +++++++++++++ pkg/mcp/tools_logs_test.go | 520 +++++++++++++++++++++++++++++++++++++ 4 files changed, 728 insertions(+), 1 deletion(-) create mode 100644 pkg/mcp/tools_logs.go create mode 100644 pkg/mcp/tools_logs_test.go diff --git a/pkg/mcp/instructions.md b/pkg/mcp/instructions.md index 90ad89b37f..ec05ee4cd7 100644 --- a/pkg/mcp/instructions.md +++ b/pkg/mcp/instructions.md @@ -42,7 +42,7 @@ This is essential because: **Exceptions:** - The `list` tool operates on the cluster, not local files, so it does NOT use a path parameter (it uses namespace instead) -- The `delete` and `describe` tools each require exactly one of `path` or `name`; they do NOT support a no-argument CWD mode (the MCP server process has its own working directory unrelated to the Function being managed) +- The `delete`, `describe` and `logs` tools each require exactly one of `path` or `name`; they do NOT support a no-argument CWD mode (the MCP server process has its own working directory unrelated to the Function being managed) ## Deployment Behavior @@ -63,6 +63,7 @@ This is essential because: - Before 'invoke' → Read `func://help/invoke` - Before 'list' → Read `func://help/list` - Before 'describe' → Read `func://help/describe` +- Before 'logs' → Read `func://help/logs` - Before 'delete' → Read `func://help/delete` - Before 'run' → Read `func://help/run` @@ -168,6 +169,24 @@ A first-time deploy can be detected by checking the func.yaml for a value in the - 'namespace' is only valid together with 'name'; providing both 'path' and 'namespace' is rejected, since path mode already determines the namespace from the Function's own deploy identity - Read-only; does not modify local files or cluster resources +### logs + +- **FIRST:** Read `func://help/logs` for authoritative usage information +- Exactly one of `path` or `name` is required (same shape as `delete` / `describe`) — never both, and never neither +- `path` must be an absolute path to the Function project directory (reads func.yaml); `name` is the deployed Function name on the cluster +- The Function must already be **deployed** — in path mode the tool still talks to the cluster via the project's deploy identity, so calling it before `deploy` is a usage error, not a tool bug +- Returns a **finite snapshot** of recent logs (it prints and exits; it is not a live stream); the default is the most recent 1000 lines per pod, so the output is bounded even when you pass neither `since` nor `tail` +- Narrow it further with `since` (time window, e.g. `30s`, `5m`, `2h`) and/or a smaller `tail` (most recent lines per pod); a negative `tail` means unlimited, and is the only way to ask for every retained line +- If the payload exceeds the tool's size limit, only the most recent lines are returned and `truncated` is set to true; re-run with `tail` or `since` rather than assuming the output is complete +- **Always read `warnings` before concluding a Function produced no output.** Empty or partial `logs` with a zero exit is normal and explained there: the Function may have scaled to zero (no pods, therefore no logs), or the logs of only some of its pods could be read +- `namespace` applies when identifying the Function by `name`. In `path` mode the namespace is read from the Function's own deploy identity in func.yaml and `namespace` has no effect — the same behavior as `func logs`, which this tool does not add rules on top of +- When more than one pod serves the Function, each line is prefixed with `[pod/] ` +- `follow`/streaming is deliberately not exposed: it never terminates, so it is unusable from an agent. Use `since`/`tail` and call again to observe new output +- Only Functions deployed with the default **knative** deployer are supported; for other deployers the CLI returns an error directing you to `kubectl logs` +- `verbose` output is written to the same stream the notices come back on, so enabling it makes `warnings` considerably noisier; the returned notices are bounded and older ones are dropped when they overflow +- This tool is **read-only** — it never modifies any state +- Use logs to diagnose a deployed Function after `deploy`, especially when combined with `invoke` to trigger the Function and observe its output + ### delete - **FIRST:** Read `func://help/delete` for authoritative usage information diff --git a/pkg/mcp/mcp.go b/pkg/mcp/mcp.go index 5f439027c0..0a910dc1c2 100644 --- a/pkg/mcp/mcp.go +++ b/pkg/mcp/mcp.go @@ -137,6 +137,7 @@ func New(options ...Option) *Server { mcp.AddTool(i, invokeTool, s.invokeHandler) mcp.AddTool(i, listTool, s.listHandler) mcp.AddTool(i, describeTool, s.describeHandler) + mcp.AddTool(i, logsTool, s.logsHandler) mcp.AddTool(i, deleteTool, s.deleteHandler) mcp.AddTool(i, runTool, s.runHandler) mcp.AddTool(i, runStopTool, s.runStopHandler) @@ -179,6 +180,7 @@ func New(options ...Option) *Server { i.AddResource(newHelpResource(s, "Invoke Help", "help for 'invoke'", "invoke")) i.AddResource(newHelpResource(s, "List Help", "help for 'list'", "list")) i.AddResource(newHelpResource(s, "Describe Help", "help for 'describe'", "describe")) + i.AddResource(newHelpResource(s, "Logs Help", "help for 'logs'", "logs")) i.AddResource(newHelpResource(s, "Delete Help", "help for delete", "delete")) i.AddResource(newHelpResource(s, "Volumes Help", "general help for volumes", "config", "volumes")) diff --git a/pkg/mcp/tools_logs.go b/pkg/mcp/tools_logs.go new file mode 100644 index 0000000000..988e1017ba --- /dev/null +++ b/pkg/mcp/tools_logs.go @@ -0,0 +1,186 @@ +package mcp + +import ( + "context" + "fmt" + "strconv" + "strings" + "unicode/utf8" + + "github.com/modelcontextprotocol/go-sdk/mcp" +) + +// defaultTailLines bounds at the source how much log output the CLI is asked +// to gather when the caller has not bounded it themselves. 'func logs' +// defaults to every line the Function's pods have retained, and the executor +// buffers that in full before this package sees any of it, so a default is +// applied here rather than gathering everything and discarding most of it +// after the fact. It is declared in the tool's input schema, and a negative +// 'tail' still means unlimited, exactly as it does in the CLI. +const defaultTailLines = 1000 + +// maxLogBytes is a backstop on the log payload returned to the caller, for +// the cases defaultTailLines does not bound: an explicitly large (or +// unlimited) 'tail', or a Function served by many pods, each contributing its +// own tail. The most recent lines are kept, and the fact that older lines +// were dropped is reported via LogsOutput.Truncated rather than being silent. +const maxLogBytes = 256 * 1024 + +// maxWarningBytes bounds the notices returned alongside the logs. stderr is +// not necessarily a line or two: 'verbose' writes its output there, as does +// one warning per pod whose logs could not be read, so it needs a bound of +// its own rather than being returned whole. +const maxWarningBytes = 8 * 1024 + +// warningsTruncatedMarker introduces a warnings payload which was itself too +// large to return, so that the notices which remain are not mistaken for all +// of them. +const warningsTruncatedMarker = "[...older notices omitted...]" + +var logsTool = &mcp.Tool{ + Name: "logs", + Title: "Get Function Logs", + Description: "Retrieve a finite snapshot of recent logs from a deployed Function (prints and returns, does not stream). Returns the most recent 1000 lines per pod by default; bound it explicitly with 'tail' and/or 'since' (time window, e.g. '5m'). Identify the Function by path (reads func.yaml) or by name.", + Annotations: &mcp.ToolAnnotations{ + Title: "Get Function Logs", + ReadOnlyHint: true, + // A logs snapshot is read-only but not idempotent: the same call + // made later returns a different (growing) set of log lines, so + // IdempotentHint is intentionally left unset (false). + }, +} + +func (s *Server) logsHandler(ctx context.Context, r *mcp.CallToolRequest, input LogsInput) (result *mcp.CallToolResult, output LogsOutput, err error) { + // Unlike the CLI, the MCP tool does not fall back to the server's working + // directory: an agent has no meaningful cwd, so require an explicit target. + // Exactly one of Path or Name must be provided (same shape as describe/delete). + // + // NOTE: no further validation is performed here. In particular + // 'namespace' is forwarded as given, including alongside 'path', where + // the CLI reads the namespace from the Function's own deploy identity and + // ignores the flag. Rejecting that combination would be a rule this tool + // enforces and 'func logs' does not, which is a divergence between the two + // surfaces rather than a fix. + if (input.Path != nil && input.Name != nil) || (input.Path == nil && input.Name == nil) { + err = fmt.Errorf("exactly one of 'path' or 'name' must be provided") + return + } + + // ExecuteSplit (rather than Execute/CombinedOutput) is required here so + // that the log content is clean stdout only. `func logs` uses stderr for + // everything which is not a log line, including notices which accompany a + // successful, zero-exit call: that the Function has scaled to zero and so + // has no logs, and that the logs of some (but not all) of its pods could + // be read. Those are surfaced separately as Warnings, since an empty or + // partial payload is otherwise indistinguishable from a complete one. + stdout, stderr, err := s.executor.ExecuteSplit(ctx, "logs", input.Args()...) + if err != nil { + err = fmt.Errorf("%w\nstdout: %s\nstderr: %s", err, string(stdout), string(stderr)) + return + } + + // Truncation of the logs is reported by Truncated alone. It is + // deliberately not also described in Warnings: two channels for one fact + // invite the caller to report it twice, and Warnings is what the CLI + // said, not what this tool did to the payload. + logs, truncated := truncateTail(string(stdout), maxLogBytes) + + warnings, warningsTruncated := truncateTail(strings.TrimSpace(string(stderr)), maxWarningBytes) + if warningsTruncated { + warnings = warningsTruncatedMarker + "\n" + warnings + } + + output = LogsOutput{ + Logs: logs, + Truncated: truncated, + Warnings: warnings, + } + return +} + +// truncateTail bounds s to its last 'limit' bytes, keeping the most recent lines +// and reporting whether anything was dropped. +// +// Whole lines are preserved in both directions: the first line returned is +// never a fragment of an older one, and no complete line is discarded in +// order to reach a line boundary the cut had already landed on. A single +// line longer than the limit is the one case which cannot be honored; its tail is +// returned, trimmed to a rune boundary so that the result is still valid +// UTF-8. +func truncateTail(s string, limit int) (string, bool) { + if len(s) <= limit { + return s, false + } + cut := len(s) - limit // >= 1, since len(s) > limit + + // A cut which lands immediately after a newline already begins a whole, + // intact line. Searching forward for a newline from here would find that + // line's own terminator and silently drop the entire line. + if s[cut-1] == '\n' { + return s[cut:], true + } + + // Otherwise the cut landed inside a line; drop that line's remainder. + if i := strings.IndexByte(s[cut:], '\n'); i >= 0 { + return s[cut+i+1:], true + } + + // No newline anywhere in the retained window: a single line longer than + // the limit, such as one JSON log record or an un-terminated stack trace. + return trimPartialRune(s[cut:]), true +} + +// trimPartialRune drops the leading bytes of a UTF-8 sequence which a +// byte-wise cut left incomplete, so that s begins on a rune boundary. +// Without it, cutting multi-byte content mid-rune yields invalid UTF-8, which +// JSON encoding replaces with U+FFFD. +func trimPartialRune(s string) string { + for i := 0; i < len(s) && i < utf8.UTFMax; i++ { + if utf8.RuneStart(s[i]) { + return s[i:] + } + } + return s +} + +// LogsInput defines the input parameters for the logs tool. +// Exactly one of Path or Name must be provided. +type LogsInput struct { + Path *string `json:"path,omitempty" jsonschema:"Absolute path to the Function project directory (mutually exclusive with name)"` + Name *string `json:"name,omitempty" jsonschema:"Name of the deployed Function to fetch logs for (mutually exclusive with path)"` + Namespace *string `json:"namespace,omitempty" jsonschema:"Kubernetes namespace of the Function (default: current namespace). Applies when identifying the Function by 'name'; in 'path' mode the namespace is read from the Function's own deploy identity in func.yaml and this has no effect, as in the CLI"` + Since *string `json:"since,omitempty" jsonschema:"Return logs newer than a relative duration such as 30s, 5m, or 2h (default: all retained logs, subject to tail)"` + Tail *int `json:"tail,omitempty" jsonschema:"Number of most recent log lines to return per pod (default: 1000; a negative value means unlimited, as in the CLI). Lower it, or add 'since', to bound a large or unknown log volume further"` + Verbose *bool `json:"verbose,omitempty" jsonschema:"Enable verbose logging output. Note this is written to the same stream as the notices returned in 'warnings'"` +} + +func (i LogsInput) Args() []string { + args := []string{} + + if i.Path != nil { + args = append(args, "--path", *i.Path) + } else if i.Name != nil { + args = append(args, "--name", *i.Name) + } + + args = appendStringFlag(args, "--namespace", i.Namespace) + args = appendStringFlag(args, "--since", i.Since) + + // Always bounded at the source: the caller's value when given, otherwise + // the default. See defaultTailLines. + tail := defaultTailLines + if i.Tail != nil { + tail = *i.Tail + } + args = append(args, "--tail", strconv.Itoa(tail)) + + args = appendBoolFlag(args, "--verbose", i.Verbose) + return args +} + +// LogsOutput defines the structured output returned by the logs tool. +type LogsOutput struct { + Logs string `json:"logs" jsonschema:"Log output from the deployed Function. When more than one pod is serving the Function, each line is prefixed with the pod it came from"` + Truncated bool `json:"truncated,omitempty" jsonschema:"True if older lines were dropped because the output exceeded the tool's size limit; only the most recent lines are included. Re-run with a smaller 'tail' or a shorter 'since' window rather than assuming the output is complete"` + Warnings string `json:"warnings,omitempty" jsonschema:"Non-fatal notices the CLI emitted while gathering the logs. Empty or partial output is explained here: that the Function has scaled to zero and so has no logs to print, or that the logs of some of its pods could not be read. Always check this before concluding that a Function produced no output"` +} diff --git a/pkg/mcp/tools_logs_test.go b/pkg/mcp/tools_logs_test.go new file mode 100644 index 0000000000..fedd4c1de5 --- /dev/null +++ b/pkg/mcp/tools_logs_test.go @@ -0,0 +1,520 @@ +package mcp + +import ( + "context" + "fmt" + "strconv" + "strings" + "testing" + "unicode/utf8" + + "github.com/modelcontextprotocol/go-sdk/mcp" + "knative.dev/func/pkg/mcp/mock" +) + +// TestTool_Logs_Args_ByPath ensures the logs tool passes all arguments correctly +// when identifying the Function by path, and returns the executor's stdout as +// the log content. +func TestTool_Logs_Args_ByPath(t *testing.T) { + stringFlags := map[string]struct { + jsonKey string + flag string + value string + }{ + "path": {"path", "--path", "/home/user/myfunc"}, + "since": {"since", "--since", "10m"}, + } + + boolFlags := map[string]string{ + "verbose": "--verbose", + } + + const wantLogs = "2024/01/01 12:00:00 INFO handler invoked\n" + + executor := mock.NewExecutor() + executor.ExecuteSplitFn = func(ctx context.Context, subcommand string, args ...string) ([]byte, []byte, error) { + if subcommand != "logs" { + t.Fatalf("expected subcommand 'logs', got %q", subcommand) + } + // '--tail 20' is a flag/value pair like the string flags, but is + // passed as an integer in the tool's input schema, so it is checked + // separately from the table-driven string flags. + validateArgLength(t, args, len(stringFlags)+1, len(boolFlags)) + validateStringFlags(t, args, stringFlags) + validateBoolFlags(t, args, boolFlags) + if got := argsToMap(args)["--tail"]; got != "20" { + t.Fatalf("expected --tail 20, got %q", got) + } + return []byte(wantLogs), nil, nil + } + + client, _, err := newTestPair(t, WithExecutor(executor)) + if err != nil { + t.Fatal(err) + } + + args := buildInputArgs(stringFlags, boolFlags) + args["tail"] = 20 + + result, err := client.CallTool(t.Context(), &mcp.CallToolParams{ + Name: "logs", + Arguments: args, + }) + if err != nil { + t.Fatal(err) + } + if result.IsError { + t.Fatalf("unexpected error result: %v", result) + } + if !executor.ExecuteSplitInvoked { + t.Fatal("executor was not invoked") + } + + var output LogsOutput + if err := unmarshalStructuredContent(result, &output); err != nil { + t.Fatal(err) + } + if output.Logs != wantLogs { + t.Errorf("expected logs %q, got %q", wantLogs, output.Logs) + } + if output.Truncated { + t.Error("expected output to not be marked truncated") + } +} + +// TestTool_Logs_Args_ByName ensures the logs tool passes --name when the +// Function is identified by name instead of path, that 'namespace' is +// forwarded in this mode, and that the log content is returned. +func TestTool_Logs_Args_ByName(t *testing.T) { + stringFlags := map[string]struct { + jsonKey string + flag string + value string + }{ + "name": {"name", "--name", "my-function"}, + "namespace": {"namespace", "--namespace", "prod"}, + } + + boolFlags := map[string]string{} + + const wantLogs = "log line 1\nlog line 2\n" + + executor := mock.NewExecutor() + executor.ExecuteSplitFn = func(ctx context.Context, subcommand string, args ...string) ([]byte, []byte, error) { + if subcommand != "logs" { + t.Fatalf("expected subcommand 'logs', got %q", subcommand) + } + // No 'tail' was provided, so the default bound is forwarded in + // addition to the flags under test. + validateArgLength(t, args, len(stringFlags)+1, len(boolFlags)) + validateStringFlags(t, args, stringFlags) + if got := argsToMap(args)["--tail"]; got != strconv.Itoa(defaultTailLines) { + t.Fatalf("expected --tail %d, got %q", defaultTailLines, got) + } + return []byte(wantLogs), nil, nil + } + + client, _, err := newTestPair(t, WithExecutor(executor)) + if err != nil { + t.Fatal(err) + } + + result, err := client.CallTool(t.Context(), &mcp.CallToolParams{ + Name: "logs", + Arguments: buildInputArgs(stringFlags, boolFlags), + }) + if err != nil { + t.Fatal(err) + } + if result.IsError { + t.Fatalf("unexpected error result: %v", result) + } + if !executor.ExecuteSplitInvoked { + t.Fatal("executor was not invoked") + } + + var output LogsOutput + if err := unmarshalStructuredContent(result, &output); err != nil { + t.Fatal(err) + } + if output.Logs != wantLogs { + t.Errorf("expected logs %q, got %q", wantLogs, output.Logs) + } +} + +// TestTool_Logs_MutuallyExclusive ensures that providing both 'path' and 'name' +// returns an error rather than executing the command. +func TestTool_Logs_MutuallyExclusive(t *testing.T) { + executor := mock.NewExecutor() + executor.ExecuteSplitFn = func(ctx context.Context, subcommand string, args ...string) ([]byte, []byte, error) { + t.Fatal("executor should not be called when both path and name are provided") + return nil, nil, nil + } + + client, _, err := newTestPair(t, WithExecutor(executor)) + if err != nil { + t.Fatal(err) + } + + result, err := client.CallTool(t.Context(), &mcp.CallToolParams{ + Name: "logs", + Arguments: map[string]any{ + "path": "/home/user/myfunc", + "name": "my-function", + }, + }) + if err != nil { + t.Fatal(err) + } + if !result.IsError { + t.Fatal("expected an error result when both path and name are provided") + } +} + +// TestTool_Logs_RequiresPathOrName ensures the logs tool errors when neither +// 'path' nor 'name' is provided. Unlike the CLI, the MCP tool does not fall +// back to the server's working directory, since an agent has no meaningful cwd. +func TestTool_Logs_RequiresPathOrName(t *testing.T) { + executor := mock.NewExecutor() + executor.ExecuteSplitFn = func(ctx context.Context, subcommand string, args ...string) ([]byte, []byte, error) { + t.Fatal("executor should not be called when neither path nor name is provided") + return nil, nil, nil + } + + client, _, err := newTestPair(t, WithExecutor(executor)) + if err != nil { + t.Fatal(err) + } + + result, err := client.CallTool(t.Context(), &mcp.CallToolParams{ + Name: "logs", + Arguments: map[string]any{}, + }) + if err != nil { + t.Fatal(err) + } + if !result.IsError { + t.Fatal("expected an error result when neither path nor name is provided") + } +} + +// TestTool_Logs_NamespaceWithPath ensures 'namespace' is forwarded even when +// combined with 'path', rather than being rejected. The CLI accepts the +// combination (it reads the namespace from the Function's own deploy identity +// and ignores the flag), so rejecting it here would make the tool enforce a +// rule 'func logs' does not. +func TestTool_Logs_NamespaceWithPath(t *testing.T) { + executor := mock.NewExecutor() + executor.ExecuteSplitFn = func(ctx context.Context, subcommand string, args ...string) ([]byte, []byte, error) { + argsMap := argsToMap(args) + if got := argsMap["--path"]; got != "/home/user/myfunc" { + t.Fatalf("expected --path /home/user/myfunc, got %q", got) + } + if got := argsMap["--namespace"]; got != "prod" { + t.Fatalf("expected --namespace prod, got %q", got) + } + return []byte("log line\n"), nil, nil + } + + client, _, err := newTestPair(t, WithExecutor(executor)) + if err != nil { + t.Fatal(err) + } + + result, err := client.CallTool(t.Context(), &mcp.CallToolParams{ + Name: "logs", + Arguments: map[string]any{ + "path": "/home/user/myfunc", + "namespace": "prod", + }, + }) + if err != nil { + t.Fatal(err) + } + if result.IsError { + t.Fatalf("unexpected error result: %v", result) + } + if !executor.ExecuteSplitInvoked { + t.Fatal("executor was not invoked") + } +} + +// TestTool_Logs_TailUnlimited ensures an explicit negative 'tail' is passed +// through rather than being replaced by the default bound. Negative means +// unlimited in the CLI, and is the caller's only way to ask for every +// retained line. +func TestTool_Logs_TailUnlimited(t *testing.T) { + executor := mock.NewExecutor() + executor.ExecuteSplitFn = func(ctx context.Context, subcommand string, args ...string) ([]byte, []byte, error) { + if got := argsToMap(args)["--tail"]; got != "-1" { + t.Fatalf("expected --tail -1, got %q", got) + } + return []byte("log line\n"), nil, nil + } + + client, _, err := newTestPair(t, WithExecutor(executor)) + if err != nil { + t.Fatal(err) + } + + result, err := client.CallTool(t.Context(), &mcp.CallToolParams{ + Name: "logs", + Arguments: map[string]any{"name": "myfunc", "tail": -1}, + }) + if err != nil { + t.Fatal(err) + } + if result.IsError { + t.Fatalf("unexpected error result: %v", result) + } +} + +// TestTool_Logs_Warnings ensures the notices 'func logs' writes to stderr on an +// otherwise-successful call are surfaced rather than discarded, and that they +// do not leak into the log content itself. A Function scaled to zero exits +// zero with empty stdout, which is otherwise indistinguishable from a Function +// which ran and printed nothing. +func TestTool_Logs_Warnings(t *testing.T) { + const notice = "No running or recently terminated pods found for function 'myfunc' in namespace 'prod'. It may have scaled to zero, in which case there are no logs to print." + + executor := mock.NewExecutor() + executor.ExecuteSplitFn = func(ctx context.Context, subcommand string, args ...string) ([]byte, []byte, error) { + return nil, []byte(notice + "\n"), nil + } + + client, _, err := newTestPair(t, WithExecutor(executor)) + if err != nil { + t.Fatal(err) + } + + result, err := client.CallTool(t.Context(), &mcp.CallToolParams{ + Name: "logs", + Arguments: map[string]any{"name": "myfunc", "namespace": "prod"}, + }) + if err != nil { + t.Fatal(err) + } + if result.IsError { + t.Fatalf("unexpected error result: %v", result) + } + + var output LogsOutput + if err := unmarshalStructuredContent(result, &output); err != nil { + t.Fatal(err) + } + if output.Logs != "" { + t.Errorf("expected empty logs, got %q", output.Logs) + } + if output.Warnings != notice { + t.Errorf("expected warnings %q, got %q", notice, output.Warnings) + } +} + +// TestTool_Logs_Truncated ensures a log payload larger than the limit is +// bounded to its most recent lines and reported as truncated, rather than +// being returned whole or silently shortened. +func TestTool_Logs_Truncated(t *testing.T) { + const lastLine = "the most recent line\n" + oversized := strings.Repeat("a log line of some length\n", (maxLogBytes/26)+100) + lastLine + + executor := mock.NewExecutor() + executor.ExecuteSplitFn = func(ctx context.Context, subcommand string, args ...string) ([]byte, []byte, error) { + return []byte(oversized), nil, nil + } + + client, _, err := newTestPair(t, WithExecutor(executor)) + if err != nil { + t.Fatal(err) + } + + result, err := client.CallTool(t.Context(), &mcp.CallToolParams{ + Name: "logs", + Arguments: map[string]any{"name": "myfunc"}, + }) + if err != nil { + t.Fatal(err) + } + if result.IsError { + t.Fatalf("unexpected error result: %v", result) + } + + var output LogsOutput + if err := unmarshalStructuredContent(result, &output); err != nil { + t.Fatal(err) + } + if !output.Truncated { + t.Error("expected output to be marked truncated") + } + if len(output.Logs) > maxLogBytes { + t.Errorf("expected at most %d bytes of logs, got %d", maxLogBytes, len(output.Logs)) + } + if !strings.HasSuffix(output.Logs, lastLine) { + t.Error("expected the most recent lines to be retained") + } + if first, _, _ := strings.Cut(output.Logs, "\n"); first != "a log line of some length" { + t.Errorf("expected truncation to a line boundary, got partial first line %q", first) + } + // Truncation is reported by 'truncated' alone. Repeating it in + // 'warnings' would give the caller two channels for one fact, and + // 'warnings' is reserved for what the CLI reported. + if output.Warnings != "" { + t.Errorf("expected truncation to be reported by 'truncated' only, got warnings %q", output.Warnings) + } +} + +// TestTool_Logs_WarningsBounded ensures the notices returned alongside the +// logs are themselves bounded. stderr is not guaranteed to be a line or two: +// 'verbose' writes there, as does one warning per unreadable pod, so an +// unbounded 'warnings' would defeat the cap on the payload as a whole. +func TestTool_Logs_WarningsBounded(t *testing.T) { + const lastNotice = "Warning: the newest notice" + oversized := strings.Repeat("Warning: a pod's logs could not be read\n", (maxWarningBytes/40)+100) + lastNotice + + executor := mock.NewExecutor() + executor.ExecuteSplitFn = func(ctx context.Context, subcommand string, args ...string) ([]byte, []byte, error) { + return []byte("log line\n"), []byte(oversized), nil + } + + client, _, err := newTestPair(t, WithExecutor(executor)) + if err != nil { + t.Fatal(err) + } + + result, err := client.CallTool(t.Context(), &mcp.CallToolParams{ + Name: "logs", + Arguments: map[string]any{"name": "myfunc"}, + }) + if err != nil { + t.Fatal(err) + } + if result.IsError { + t.Fatalf("unexpected error result: %v", result) + } + + var output LogsOutput + if err := unmarshalStructuredContent(result, &output); err != nil { + t.Fatal(err) + } + if len(output.Warnings) > maxWarningBytes+len(warningsTruncatedMarker)+1 { + t.Errorf("expected warnings bounded to ~%d bytes, got %d", maxWarningBytes, len(output.Warnings)) + } + if !strings.HasPrefix(output.Warnings, warningsTruncatedMarker) { + t.Error("expected dropped notices to be marked, so the remainder is not mistaken for all of them") + } + if !strings.HasSuffix(output.Warnings, lastNotice) { + t.Error("expected the most recent notices to be retained") + } + // Bounding the notices must not be confused with bounding the logs. + if output.Truncated { + t.Error("expected 'truncated' to describe the logs only, not the warnings") + } +} + +// TestTruncateTail exercises the bounding directly, with a small limit so the +// boundary cases are exact. Two of them are regressions: a cut which lands on +// a line boundary must not consume the intact line which begins there, and a +// line longer than the limit must not be returned as a broken rune. +func TestTruncateTail(t *testing.T) { + tests := []struct { + name string + logs string + limit int + want string + wantTruncated bool + }{ + { + name: "under the limit is returned whole", + logs: "aaaa\nbbbb\n", limit: 100, + want: "aaaa\nbbbb\n", wantTruncated: false, + }, + { + name: "exactly at the limit is returned whole", + logs: "aaaa\nbbbb\n", limit: 10, + want: "aaaa\nbbbb\n", wantTruncated: false, + }, + { + // The cut falls immediately after "aaaa\n", so "bbbb" is a + // whole, intact line. Searching forward for a newline from + // there would find that line's own terminator and drop it. + name: "cut on a line boundary keeps the line beginning there", + logs: "aaaa\nbbbb\ncccc\n", limit: 10, + want: "bbbb\ncccc\n", wantTruncated: true, + }, + { + // The cut falls inside "aaaa", whose remainder must go. + name: "cut inside a line drops that line's remainder", + logs: "aaaa\nbbbb\ncccc\n", limit: 12, + want: "bbbb\ncccc\n", wantTruncated: true, + }, + { + name: "single line longer than the limit keeps its tail", + logs: "abcdef", limit: 3, + want: "def", wantTruncated: true, + }, + { + // Three-byte runes and no newline to re-align on: a byte-wise + // cut lands mid-rune and would otherwise emit invalid UTF-8, + // which JSON encoding silently replaces with U+FFFD. + name: "single long line is trimmed to a rune boundary", + logs: "世世世世", limit: 5, + want: "世", wantTruncated: true, + }, + { + // Content which was not valid UTF-8 to begin with (binary + // written to stdout) cannot be made valid by trimming. The + // contract is only that this introduces no corruption of its + // own, so such input is passed through as it was found. + name: "input which is already invalid UTF-8 is passed through", + logs: "\xb8\xb8\xb8\xb8", limit: 3, + want: "\xb8\xb8\xb8", wantTruncated: true, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got, truncated := truncateTail(tt.logs, tt.limit) + if got != tt.want { + t.Errorf("expected %q, got %q", tt.want, got) + } + if truncated != tt.wantTruncated { + t.Errorf("expected truncated %v, got %v", tt.wantTruncated, truncated) + } + if len(got) > tt.limit && tt.limit > 0 { + t.Errorf("expected at most %d bytes, got %d", tt.limit, len(got)) + } + // Bounding must not introduce invalid UTF-8 into content which + // was valid: JSON encoding replaces it with U+FFFD. + if utf8.ValidString(tt.logs) && !utf8.ValidString(got) { + t.Errorf("expected valid UTF-8, got % x", got) + } + }) + } +} + +// TestTool_Logs_ExecutorError ensures a failed command surfaces as a tool error +// which includes both streams, since the CLI reports why it failed on stderr. +func TestTool_Logs_ExecutorError(t *testing.T) { + executor := mock.NewExecutor() + executor.ExecuteSplitFn = func(ctx context.Context, subcommand string, args ...string) ([]byte, []byte, error) { + return nil, []byte("function not deployed or not found"), fmt.Errorf("exit status 1") + } + + client, _, err := newTestPair(t, WithExecutor(executor)) + if err != nil { + t.Fatal(err) + } + + result, err := client.CallTool(t.Context(), &mcp.CallToolParams{ + Name: "logs", + Arguments: map[string]any{"name": "myfunc"}, + }) + if err != nil { + t.Fatal(err) + } + if !result.IsError { + t.Fatal("expected an error result when the command fails") + } + if msg := resultToString(result); !strings.Contains(msg, "function not deployed or not found") { + t.Errorf("expected the command's stderr in the error, got %q", msg) + } +} From c24bf20cc2ac0d1d532a22e78971510963176c06 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Thu, 27 Aug 2026 10:32:18 +0000 Subject: [PATCH 04/38] chore: update Quarkus platform version to 3.39.1 (#4025) Co-authored-by: Knative Automation --- generate/zz_filesystem_generated.go | 126 +++++++++++++------------- templates/quarkus/cloudevents/pom.xml | 2 +- templates/quarkus/http/pom.xml | 2 +- 3 files changed, 65 insertions(+), 65 deletions(-) diff --git a/generate/zz_filesystem_generated.go b/generate/zz_filesystem_generated.go index 8155971d63..bda98b8358 100644 --- a/generate/zz_filesystem_generated.go +++ b/generate/zz_filesystem_generated.go @@ -7089,39 +7089,39 @@ var TemplatesZip = []byte{ 0xc4, 0x93, 0x44, 0x83, 0x7f, 0x47, 0x67, 0x8e, 0xf4, 0x61, 0x02, 0x75, 0x2c, 0x4f, 0xbb, 0x76, 0xe7, 0xf4, 0xfc, 0x70, 0xf3, 0x3f, 0x01, 0x00, 0x00, 0xff, 0xff, 0x50, 0x4b, 0x07, 0x08, 0x68, 0x33, 0xee, 0xa3, 0xf6, 0x0a, 0x00, 0x00, 0xa7, 0x1d, 0x00, 0x00, 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x08, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1b, 0x00, 0x00, 0x00, 0x71, 0x75, 0x61, 0x72, 0x6b, 0x75, 0x73, 0x2f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2f, 0x70, 0x6f, 0x6d, - 0x2e, 0x78, 0x6d, 0x6c, 0xbc, 0x57, 0x51, 0x6f, 0xdc, 0x28, 0x10, 0x7e, 0xdf, 0x5f, 0x61, 0x45, 0x79, 0x35, 0x64, 0x2f, 0x77, 0x6a, 0x15, 0x71, 0x54, 0x7d, 0xb8, 0xd3, 0x45, 0x4a, 0xda, 0x48, - 0xc9, 0x55, 0xf7, 0x4a, 0xf0, 0xd8, 0x4b, 0x62, 0xc0, 0x05, 0xbc, 0xd9, 0x55, 0xb4, 0xff, 0xfd, 0x04, 0xd8, 0x5e, 0xdb, 0x6b, 0x27, 0x69, 0xb4, 0xed, 0x9b, 0x99, 0xf9, 0x66, 0x18, 0xbe, 0x19, - 0x0f, 0x03, 0xf9, 0xb4, 0x91, 0x65, 0xb2, 0x06, 0x63, 0x85, 0x56, 0x7f, 0x9e, 0x2c, 0xd1, 0xd9, 0xc9, 0x27, 0xba, 0x20, 0x95, 0xd1, 0x0f, 0xc0, 0x5d, 0xb2, 0xb1, 0xe2, 0xc2, 0xf2, 0x15, 0x48, - 0x76, 0xa5, 0x39, 0x73, 0x01, 0xb3, 0x72, 0xae, 0xba, 0xc0, 0x58, 0xb2, 0x35, 0x28, 0xc4, 0x2a, 0xc6, 0x57, 0x80, 0xb4, 0x29, 0xf0, 0xcd, 0xd7, 0x6b, 0xfc, 0x3b, 0x3a, 0x43, 0x67, 0x89, 0x47, + 0x2e, 0x78, 0x6d, 0x6c, 0xbc, 0x57, 0x51, 0x6f, 0xe4, 0x26, 0x10, 0x7e, 0xdf, 0x5f, 0x61, 0x45, 0x79, 0x35, 0x64, 0x9b, 0x56, 0xbd, 0x46, 0x94, 0xd3, 0x3d, 0xb4, 0x6a, 0xa4, 0xe4, 0x2e, 0x52, + 0xd2, 0x53, 0x5f, 0x09, 0x1e, 0x7b, 0x49, 0x0c, 0xf8, 0x00, 0x6f, 0x76, 0x15, 0xed, 0x7f, 0xaf, 0x00, 0xdb, 0x6b, 0x7b, 0xed, 0x24, 0x17, 0xed, 0xdd, 0x9b, 0x99, 0xf9, 0x66, 0x18, 0xbe, 0x19, + 0x0f, 0x03, 0xf9, 0xb8, 0x91, 0x65, 0xb2, 0x06, 0x63, 0x85, 0x56, 0x7f, 0x9e, 0x2c, 0xd1, 0xd9, 0xc9, 0x47, 0xba, 0x20, 0x95, 0xd1, 0x0f, 0xc0, 0x5d, 0xb2, 0xb1, 0xe2, 0xc2, 0xf2, 0x15, 0x48, + 0x76, 0xa5, 0x39, 0x73, 0x01, 0xb3, 0x72, 0xae, 0xba, 0xc0, 0x58, 0xb2, 0x35, 0x28, 0xc4, 0x2a, 0xc6, 0x57, 0x80, 0xb4, 0x29, 0xf0, 0xcd, 0x97, 0x6b, 0xfc, 0x2b, 0x3a, 0x43, 0x67, 0x89, 0x47, 0xd8, 0x29, 0xc8, 0xc6, 0x66, 0x51, 0x98, 0x06, 0x20, 0xda, 0xd8, 0xec, 0x24, 0xd9, 0xc8, 0x52, 0xd9, 0x37, 0xb8, 0x3d, 0x59, 0x24, 0x49, 0x12, 0xd1, 0x17, 0x1b, 0x2b, 0x3a, 0x8b, 0xa7, 0xa7, - 0x27, 0xf4, 0x74, 0x1e, 0xb0, 0xbf, 0x9d, 0x9d, 0x2d, 0xf1, 0x7f, 0xd7, 0x57, 0xb7, 0x21, 0xe4, 0x54, 0x28, 0xeb, 0x98, 0xe2, 0x70, 0x42, 0x17, 0x49, 0x42, 0xa4, 0xce, 0xa0, 0xfc, 0x16, 0x4f, + 0x27, 0xf4, 0x74, 0x1e, 0xb0, 0xbf, 0x9c, 0x9d, 0x2d, 0xf1, 0x7f, 0xd7, 0x57, 0xb7, 0x21, 0xe4, 0x54, 0x28, 0xeb, 0x98, 0xe2, 0x70, 0x42, 0x17, 0x49, 0x42, 0xa4, 0xce, 0xa0, 0xfc, 0x1a, 0x4f, 0x4a, 0x83, 0x47, 0x82, 0x07, 0x32, 0x0f, 0x2a, 0x8c, 0xae, 0xab, 0xcb, 0x8c, 0x6a, 0x53, 0x20, 0xc6, 0x25, 0x10, 0xdc, 0x4a, 0xbc, 0x96, 0x19, 0x27, 0x72, 0xc6, 0xdd, 0x65, 0x46, 0xf3, 0x5a, - 0x71, 0xcf, 0x07, 0xc1, 0x3d, 0xa1, 0xc7, 0x34, 0x5c, 0xd2, 0xa5, 0xdf, 0x21, 0xbd, 0xfd, 0xf2, 0xf9, 0xe6, 0xf6, 0x9f, 0xaf, 0x77, 0x04, 0xaf, 0x7b, 0xbb, 0x54, 0x46, 0x57, 0x60, 0x9c, 0x00, - 0x4b, 0xc3, 0xa1, 0x08, 0xd7, 0xb2, 0x12, 0x25, 0x98, 0xb4, 0x2a, 0xeb, 0x42, 0x28, 0xd4, 0x82, 0xcf, 0xd1, 0x47, 0xb4, 0x24, 0x78, 0x4e, 0x1d, 0x8d, 0x23, 0x65, 0x2d, 0x06, 0x19, 0x28, 0x81, - 0x59, 0xa0, 0xcb, 0x25, 0xc1, 0x33, 0xaa, 0x68, 0xd7, 0x24, 0x19, 0xdd, 0xd7, 0xa2, 0xcc, 0x90, 0xd5, 0xb5, 0xe1, 0xf0, 0x97, 0xe2, 0x3a, 0x13, 0xaa, 0xa0, 0xff, 0xde, 0xfd, 0x9d, 0x7e, 0x24, - 0xf8, 0x45, 0xcc, 0xd0, 0x8d, 0x81, 0x4a, 0x1b, 0x27, 0x54, 0x81, 0x74, 0xed, 0xaa, 0xda, 0xcd, 0xb9, 0x9a, 0xc5, 0x45, 0x77, 0xdf, 0x6b, 0x66, 0x1e, 0x6b, 0x8b, 0xaa, 0x92, 0xb9, 0x5c, 0x1b, + 0x71, 0xcf, 0x07, 0xc1, 0x3d, 0xa1, 0xc7, 0x34, 0x5c, 0xd2, 0xa5, 0xdf, 0x21, 0xbd, 0xfd, 0xfc, 0xe9, 0xe6, 0xf6, 0x9f, 0x2f, 0x77, 0x04, 0xaf, 0x7b, 0xbb, 0x54, 0x46, 0x57, 0x60, 0x9c, 0x00, + 0x4b, 0xc3, 0xa1, 0x08, 0xd7, 0xb2, 0x12, 0x25, 0x98, 0xb4, 0x2a, 0xeb, 0x42, 0x28, 0xd4, 0x82, 0xcf, 0xd1, 0x07, 0xb4, 0x24, 0x78, 0x4e, 0x1d, 0x8d, 0x23, 0x65, 0x2d, 0x06, 0x19, 0x28, 0x81, + 0x59, 0xa0, 0xcb, 0x25, 0xc1, 0x33, 0xaa, 0x68, 0xd7, 0x24, 0x19, 0xdd, 0xd7, 0xa2, 0xcc, 0x90, 0xd5, 0xb5, 0xe1, 0xf0, 0x97, 0xe2, 0x3a, 0x13, 0xaa, 0xa0, 0xff, 0xde, 0xfd, 0x9d, 0x7e, 0x20, + 0xf8, 0x45, 0xcc, 0xd0, 0x8d, 0x81, 0x4a, 0x1b, 0x27, 0x54, 0x81, 0x74, 0xed, 0xaa, 0xda, 0xcd, 0xb9, 0x9a, 0xc5, 0x45, 0x77, 0xdf, 0x6a, 0x66, 0x1e, 0x6b, 0x8b, 0xaa, 0x92, 0xb9, 0x5c, 0x1b, 0x89, 0x5a, 0x7e, 0x53, 0x91, 0xd1, 0x46, 0x99, 0xde, 0x6b, 0x49, 0xf0, 0x8b, 0xc8, 0x19, 0x67, 0x21, 0x9b, 0x5e, 0x2f, 0x34, 0x1a, 0x2b, 0x27, 0x3c, 0x76, 0xf0, 0x19, 0x77, 0xfb, 0x3c, 0x9d, - 0x7f, 0xf0, 0x89, 0x9a, 0x05, 0x44, 0x7b, 0xfb, 0x28, 0xaa, 0xcb, 0x3b, 0x4b, 0x9d, 0xa9, 0x81, 0xe0, 0x76, 0xd5, 0xe8, 0x6a, 0x03, 0xb9, 0x30, 0x70, 0x58, 0x02, 0xbe, 0x8e, 0xae, 0x3f, 0x10, - 0x3c, 0x87, 0xf0, 0x15, 0x85, 0x87, 0x25, 0x45, 0x32, 0xa8, 0x40, 0x65, 0xa0, 0xf8, 0xf6, 0x9a, 0x29, 0x56, 0x80, 0x04, 0xe5, 0x9a, 0x8d, 0x3a, 0x55, 0x57, 0x7e, 0x03, 0x7c, 0x2b, 0xea, 0xfd, - 0x0c, 0xa7, 0xcf, 0xb3, 0xc4, 0xec, 0x06, 0x3f, 0x48, 0x63, 0xd7, 0xfb, 0x23, 0x26, 0x4c, 0x7b, 0x59, 0xda, 0x8d, 0xff, 0x9e, 0xc6, 0x41, 0x7b, 0xb2, 0x09, 0xeb, 0x46, 0xb5, 0x1b, 0xfc, 0x50, - 0x8d, 0x99, 0xdb, 0x56, 0x40, 0x2b, 0x5f, 0x1a, 0xe1, 0x6b, 0xaf, 0xb0, 0x5c, 0x57, 0x40, 0x85, 0xf4, 0x85, 0x47, 0x70, 0x5c, 0xb5, 0x27, 0xc7, 0xe3, 0xa3, 0xf7, 0x24, 0x2d, 0x9b, 0x78, 0x8e, - 0xce, 0x09, 0x32, 0x27, 0xa8, 0xec, 0x88, 0xdc, 0x17, 0xdd, 0x01, 0x6d, 0x7d, 0xd2, 0xda, 0x2a, 0xcf, 0x6b, 0xf5, 0x7d, 0x9b, 0x3e, 0x2a, 0xe6, 0xc4, 0x1a, 0x52, 0x58, 0x83, 0x72, 0xf6, 0x90, - 0xb1, 0x89, 0x13, 0x1c, 0x2f, 0x04, 0x2b, 0x59, 0x59, 0x9a, 0x2d, 0xa4, 0x2b, 0x60, 0xa5, 0x5b, 0xfd, 0xe2, 0xdd, 0x99, 0xe1, 0xbf, 0x78, 0xc7, 0x87, 0x5a, 0x09, 0xf7, 0xc7, 0x54, 0x59, 0x36, - 0x45, 0xe4, 0xc0, 0x0e, 0x4b, 0xe8, 0x87, 0xc3, 0x31, 0x60, 0x5d, 0xca, 0xac, 0xff, 0x9b, 0xb3, 0x17, 0x63, 0x1a, 0x02, 0xdf, 0x1f, 0xd1, 0x44, 0x41, 0x87, 0x76, 0xde, 0xa0, 0x63, 0x37, 0xd9, - 0xb7, 0x82, 0xb8, 0xa6, 0x47, 0x6d, 0x03, 0x2d, 0xbd, 0xf1, 0xf2, 0x8f, 0x3b, 0x1c, 0xf7, 0xdf, 0x87, 0x8d, 0x03, 0xe5, 0x65, 0x6d, 0x77, 0xed, 0x09, 0xfa, 0x28, 0xe0, 0xb5, 0x1b, 0x0a, 0xfb, - 0xe2, 0xbe, 0xd4, 0x9f, 0x5c, 0xb3, 0xd2, 0x0e, 0x65, 0x8d, 0x94, 0x06, 0x06, 0x09, 0x0e, 0xdf, 0x93, 0x80, 0x02, 0x14, 0x18, 0xe6, 0x20, 0xe5, 0x3a, 0x83, 0x37, 0x03, 0x53, 0x9f, 0x4d, 0x3b, - 0x05, 0x8f, 0xb2, 0x61, 0xdc, 0x78, 0x22, 0xf0, 0x9e, 0x70, 0x9f, 0x53, 0x3c, 0x4c, 0xea, 0x61, 0x8e, 0x7b, 0xa9, 0x88, 0x39, 0x1a, 0x8d, 0x1c, 0xaf, 0x26, 0x6b, 0x66, 0x44, 0x99, 0xcc, 0x15, - 0xd7, 0x2a, 0x17, 0x45, 0x6d, 0xd8, 0x98, 0xf2, 0x6e, 0x0e, 0xfa, 0x6c, 0x8a, 0x11, 0xef, 0x84, 0x99, 0x82, 0xa6, 0x15, 0x33, 0x4c, 0x82, 0x03, 0x13, 0xfa, 0x60, 0x31, 0x24, 0x63, 0xda, 0xd8, - 0xcb, 0x27, 0xb6, 0x7b, 0x07, 0x25, 0xa3, 0xfb, 0xf7, 0x55, 0x4a, 0x66, 0xee, 0xeb, 0x1f, 0xa4, 0xc4, 0x6e, 0xad, 0x03, 0x79, 0x13, 0xaf, 0xf7, 0xed, 0x37, 0x66, 0x04, 0xbb, 0x2f, 0x61, 0xcc, - 0xce, 0x03, 0x5b, 0x33, 0x54, 0x3b, 0x51, 0xa2, 0x52, 0x17, 0x85, 0x1f, 0xae, 0x64, 0xb8, 0xa8, 0x4c, 0x98, 0x64, 0x1f, 0xee, 0xb5, 0xb5, 0x5e, 0xd3, 0x08, 0xd1, 0x95, 0x2e, 0xe2, 0x45, 0x66, - 0x08, 0x9e, 0x37, 0x1d, 0x6e, 0x11, 0x67, 0xc9, 0x95, 0x96, 0x40, 0x4f, 0x9f, 0xf7, 0x8b, 0x5d, 0x3b, 0x65, 0x06, 0xcd, 0x20, 0x21, 0xaf, 0x86, 0x7e, 0xbc, 0xdc, 0xe4, 0x4c, 0x94, 0x96, 0xe5, - 0x3f, 0x25, 0x37, 0xc7, 0x6b, 0x1a, 0x42, 0x39, 0x28, 0xe2, 0x59, 0xd3, 0xd8, 0xb6, 0xe7, 0xdb, 0xc2, 0x1a, 0x8c, 0xc8, 0xb7, 0x6f, 0xec, 0x04, 0x2f, 0x55, 0x50, 0xf2, 0xe6, 0x2a, 0x0a, 0xc8, - 0x38, 0x6d, 0x20, 0x21, 0x59, 0x01, 0xa8, 0x62, 0x6e, 0x45, 0x4f, 0x9f, 0x87, 0xaf, 0x80, 0x4c, 0x18, 0xe0, 0x4e, 0x9b, 0xed, 0x0e, 0x8f, 0x55, 0xb9, 0x50, 0xac, 0xfc, 0xc2, 0x24, 0xec, 0x52, - 0x53, 0x2b, 0xe5, 0xcb, 0xeb, 0xd0, 0xdf, 0xe1, 0x9e, 0x3f, 0xbf, 0x7a, 0x93, 0xf7, 0x54, 0x70, 0xf2, 0xb6, 0x2a, 0x4e, 0xe6, 0x2b, 0x39, 0xaa, 0xde, 0xd5, 0xa5, 0xdb, 0x55, 0x33, 0x81, 0x76, - 0x37, 0xb6, 0x7f, 0x6f, 0xe5, 0xa2, 0x0b, 0xa0, 0x5d, 0x76, 0x4e, 0x44, 0x46, 0x23, 0xe5, 0x04, 0x8b, 0xde, 0x58, 0xc1, 0x9d, 0x58, 0x8f, 0x42, 0x6b, 0x9f, 0xa1, 0xdb, 0x41, 0xb4, 0x8a, 0x49, - 0xe8, 0x3c, 0x84, 0x45, 0x2f, 0xe8, 0xb1, 0x05, 0xc1, 0x87, 0x8e, 0x0f, 0x5e, 0xb7, 0x41, 0xd8, 0x3e, 0x76, 0x72, 0x56, 0xda, 0xf1, 0xdb, 0x27, 0x00, 0xba, 0xdb, 0x9e, 0xf1, 0x47, 0x5f, 0x2a, - 0x61, 0x84, 0x6f, 0xe3, 0x98, 0x54, 0x2e, 0x46, 0x51, 0xed, 0x47, 0x70, 0xdc, 0x23, 0xa5, 0x5b, 0x58, 0xba, 0xe8, 0x1e, 0xa1, 0x74, 0xf1, 0x7f, 0x00, 0x00, 0x00, 0xff, 0xff, 0x50, 0x4b, 0x07, - 0x08, 0x97, 0x9b, 0xfc, 0xbe, 0xf9, 0x03, 0x00, 0x00, 0xf9, 0x10, 0x00, 0x00, 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xff, 0xe1, 0x13, 0x35, 0x0b, 0x88, 0xf6, 0xf6, 0x51, 0x54, 0x97, 0x77, 0x96, 0x3a, 0x53, 0x03, 0xc1, 0xed, 0xaa, 0xd1, 0xd5, 0x06, 0x72, 0x61, 0xe0, 0xb0, 0x04, 0x7c, 0x1d, 0x5d, 0xff, 0x4e, + 0xf0, 0x1c, 0xc2, 0x57, 0x14, 0x1e, 0x96, 0x14, 0xc9, 0xa0, 0x02, 0x95, 0x81, 0xe2, 0xdb, 0x6b, 0xa6, 0x58, 0x01, 0x12, 0x94, 0x6b, 0x36, 0xea, 0x54, 0x5d, 0xf9, 0x0d, 0xf0, 0xad, 0xa8, 0xf7, + 0x33, 0x9c, 0x3e, 0xcf, 0x12, 0xb3, 0x1b, 0xfc, 0x20, 0x8d, 0x5d, 0xef, 0x8f, 0x98, 0x30, 0xed, 0x65, 0x69, 0x37, 0xfe, 0x7b, 0x1a, 0x07, 0xed, 0xc9, 0x26, 0xac, 0x1b, 0xd5, 0x6e, 0xf0, 0x43, + 0x35, 0x66, 0x6e, 0x5b, 0x01, 0xad, 0x7c, 0x69, 0x84, 0xaf, 0xbd, 0xc2, 0x72, 0x5d, 0x01, 0x15, 0xd2, 0x17, 0x1e, 0xc1, 0x71, 0xd5, 0x9e, 0x1c, 0x8f, 0x8f, 0xde, 0x93, 0xb4, 0x6c, 0xe2, 0x39, + 0x3a, 0x27, 0xc8, 0x9c, 0xa0, 0xb2, 0x23, 0x72, 0x5f, 0x74, 0x07, 0xb4, 0xf5, 0x49, 0x6b, 0xab, 0x3c, 0xaf, 0xd5, 0xb7, 0x6d, 0xfa, 0xa8, 0x98, 0x13, 0x6b, 0x48, 0x61, 0x0d, 0xca, 0xd9, 0x43, + 0xc6, 0x26, 0x4e, 0x70, 0xbc, 0x10, 0xac, 0x64, 0x65, 0x69, 0xb6, 0x90, 0xae, 0x80, 0x95, 0x6e, 0xf5, 0x93, 0x77, 0x67, 0x86, 0xff, 0xe4, 0x1d, 0x1f, 0x6a, 0x25, 0xdc, 0x6f, 0x53, 0x65, 0xd9, + 0x14, 0x91, 0x03, 0x3b, 0x2c, 0xa1, 0xef, 0x0e, 0xc7, 0x80, 0x75, 0x29, 0xb3, 0xfe, 0x6f, 0xce, 0x5e, 0x8c, 0x69, 0x08, 0x7c, 0x7f, 0x44, 0x13, 0x05, 0x1d, 0xda, 0x79, 0x83, 0x8e, 0xdd, 0x64, + 0xdf, 0x0a, 0xe2, 0x9a, 0x1e, 0xb5, 0x0d, 0xb4, 0xf4, 0xc6, 0xcb, 0x3f, 0xee, 0x70, 0xdc, 0x7f, 0x1f, 0x36, 0x0e, 0x94, 0x97, 0xb5, 0xdd, 0xb5, 0x27, 0xe8, 0xa3, 0x80, 0xd7, 0x6e, 0x28, 0xec, + 0x8b, 0xfb, 0x52, 0x7f, 0x72, 0xcd, 0x4a, 0x3b, 0x94, 0x35, 0x52, 0x1a, 0x18, 0x24, 0x38, 0x7c, 0x4f, 0x02, 0x0a, 0x50, 0x60, 0x98, 0x83, 0x94, 0xeb, 0x0c, 0xde, 0x0c, 0x4c, 0x7d, 0x36, 0xed, + 0x14, 0x3c, 0xca, 0x86, 0x71, 0xe3, 0x89, 0xc0, 0x7b, 0xc2, 0x7d, 0x4e, 0xf1, 0x30, 0xa9, 0x87, 0x39, 0xee, 0xa5, 0x22, 0xe6, 0x68, 0x34, 0x72, 0xbc, 0x9a, 0xac, 0x99, 0x11, 0x65, 0x32, 0x57, + 0x5c, 0xab, 0x5c, 0x14, 0xb5, 0x61, 0x63, 0xca, 0xbb, 0x39, 0xe8, 0x93, 0x29, 0x46, 0xbc, 0x13, 0x66, 0x0a, 0x9a, 0x56, 0xcc, 0x30, 0x09, 0x0e, 0x4c, 0xe8, 0x83, 0xc5, 0x90, 0x8c, 0x69, 0x63, + 0x2f, 0x9f, 0xd8, 0xee, 0x1d, 0x94, 0x8c, 0xee, 0xdf, 0x57, 0x29, 0x99, 0xb9, 0xaf, 0xbf, 0x93, 0x12, 0xbb, 0xb5, 0x0e, 0xe4, 0x4d, 0xbc, 0xde, 0xb7, 0x5f, 0x99, 0x11, 0xec, 0xbe, 0x84, 0x31, + 0x3b, 0x0f, 0x6c, 0xcd, 0x50, 0xed, 0x44, 0x89, 0x4a, 0x5d, 0x14, 0x7e, 0xb8, 0x92, 0xe1, 0xa2, 0x32, 0x61, 0x92, 0x7d, 0xb8, 0xd7, 0xd6, 0x7a, 0x4d, 0x23, 0x44, 0x57, 0xba, 0x88, 0x17, 0x99, + 0x21, 0x78, 0xde, 0x74, 0xb8, 0x45, 0x9c, 0x25, 0x57, 0x5a, 0x02, 0x3d, 0x7d, 0xde, 0x2f, 0x76, 0xed, 0x94, 0x19, 0x34, 0x83, 0x84, 0xbc, 0x1a, 0xfa, 0xf1, 0x72, 0x93, 0x33, 0x51, 0x5a, 0x96, + 0xff, 0x90, 0xdc, 0x1c, 0xaf, 0x69, 0x08, 0xe5, 0xa0, 0x88, 0x67, 0x4d, 0x63, 0xdb, 0x9e, 0x6f, 0x0b, 0x6b, 0x30, 0x22, 0xdf, 0xbe, 0xb1, 0x13, 0xbc, 0x54, 0x41, 0xc9, 0x9b, 0xab, 0x28, 0x20, + 0xe3, 0xb4, 0x81, 0x84, 0x64, 0x05, 0xa0, 0x8a, 0xb9, 0x15, 0x3d, 0x7d, 0x1e, 0xbe, 0x02, 0x32, 0x61, 0x80, 0x3b, 0x6d, 0xb6, 0x3b, 0x3c, 0x56, 0xe5, 0x42, 0xb1, 0xf2, 0x33, 0x93, 0xb0, 0x4b, + 0x4d, 0xad, 0x94, 0x2f, 0xaf, 0x43, 0x7f, 0x87, 0x7b, 0xfe, 0xf8, 0xea, 0x4d, 0xde, 0x53, 0xc1, 0xc9, 0xdb, 0xaa, 0x38, 0x99, 0xaf, 0xe4, 0xa8, 0x7a, 0x57, 0x97, 0x6e, 0x57, 0xcd, 0x04, 0xda, + 0xdd, 0xd8, 0xfe, 0xbd, 0x95, 0x8b, 0x2e, 0x80, 0x76, 0xd9, 0x39, 0x11, 0x19, 0x8d, 0x94, 0x13, 0x2c, 0x7a, 0x63, 0x05, 0x77, 0x62, 0x3d, 0x0a, 0xad, 0x7d, 0x86, 0x6e, 0x07, 0xd1, 0x2a, 0x26, + 0xa1, 0xf3, 0x10, 0x16, 0xbd, 0xa0, 0xc7, 0x16, 0x04, 0x1f, 0x3a, 0x3e, 0x78, 0xdd, 0x06, 0x61, 0xfb, 0xd8, 0xc9, 0x59, 0x69, 0xc7, 0x6f, 0x9f, 0x00, 0xe8, 0x6e, 0x7b, 0xc6, 0x1f, 0x7d, 0xa9, + 0x84, 0x11, 0xbe, 0x8d, 0x63, 0x52, 0xb9, 0x18, 0x45, 0xb5, 0x1f, 0xc1, 0x71, 0x8f, 0x94, 0x6e, 0x61, 0xe9, 0xa2, 0x7b, 0x84, 0xd2, 0xc5, 0xff, 0x01, 0x00, 0x00, 0xff, 0xff, 0x50, 0x4b, 0x07, + 0x08, 0x7b, 0x3e, 0x7e, 0x8a, 0xf9, 0x03, 0x00, 0x00, 0xf9, 0x10, 0x00, 0x00, 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x71, 0x75, 0x61, 0x72, 0x6b, 0x75, 0x73, 0x2f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2f, 0x73, 0x72, 0x63, 0x2f, 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1d, 0x00, 0x00, 0x00, 0x71, 0x75, 0x61, 0x72, 0x6b, 0x75, 0x73, 0x2f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2f, 0x73, 0x72, 0x63, 0x2f, 0x6d, 0x61, 0x69, 0x6e, 0x2f, 0x50, 0x4b, @@ -7517,38 +7517,38 @@ var TemplatesZip = []byte{ 0xdd, 0x1f, 0xc4, 0x93, 0x44, 0x83, 0x7f, 0x47, 0x67, 0x8e, 0xf4, 0x61, 0x02, 0x75, 0x2c, 0x4f, 0xbb, 0x76, 0xe7, 0xf4, 0xfc, 0x70, 0xf3, 0x3f, 0x01, 0x00, 0x00, 0xff, 0xff, 0x50, 0x4b, 0x07, 0x08, 0x68, 0x33, 0xee, 0xa3, 0xf6, 0x0a, 0x00, 0x00, 0xa7, 0x1d, 0x00, 0x00, 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x08, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00, 0x71, 0x75, 0x61, 0x72, 0x6b, 0x75, 0x73, 0x2f, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x70, 0x6f, 0x6d, 0x2e, 0x78, 0x6d, 0x6c, 0xbc, - 0x57, 0x51, 0x6f, 0xdc, 0x28, 0x10, 0x7e, 0xdf, 0x5f, 0x61, 0x45, 0x79, 0x35, 0x64, 0x2f, 0x77, 0x6a, 0x15, 0x71, 0x54, 0x7d, 0xb8, 0xd3, 0x45, 0x4a, 0xda, 0x48, 0xc9, 0x55, 0xf7, 0x4a, 0xf0, - 0xd8, 0x4b, 0x62, 0xc0, 0x05, 0xbc, 0xd9, 0x55, 0xb4, 0xff, 0xfd, 0x04, 0xd8, 0x5e, 0xdb, 0x6b, 0x27, 0x69, 0xb4, 0xed, 0x9b, 0x99, 0xf9, 0x66, 0x18, 0xbe, 0x19, 0x0f, 0x03, 0xf9, 0xb4, 0x91, - 0x65, 0xb2, 0x06, 0x63, 0x85, 0x56, 0x7f, 0x9e, 0x2c, 0xd1, 0xd9, 0xc9, 0x27, 0xba, 0x20, 0x95, 0xd1, 0x0f, 0xc0, 0x5d, 0xb2, 0xb1, 0xe2, 0xc2, 0xf2, 0x15, 0x48, 0x76, 0xa5, 0x39, 0x73, 0x01, - 0xb3, 0x72, 0xae, 0xba, 0xc0, 0x58, 0xb2, 0x35, 0x28, 0xc4, 0x2a, 0xc6, 0x57, 0x80, 0xb4, 0x29, 0xf0, 0xcd, 0xd7, 0x6b, 0xfc, 0x3b, 0x3a, 0x43, 0x67, 0x89, 0x47, 0xd8, 0x29, 0xc8, 0xc6, 0x66, + 0x57, 0x51, 0x6f, 0xe4, 0x26, 0x10, 0x7e, 0xdf, 0x5f, 0x61, 0x45, 0x79, 0x35, 0x64, 0x9b, 0x56, 0xbd, 0x46, 0x94, 0xd3, 0x3d, 0xb4, 0x6a, 0xa4, 0xe4, 0x2e, 0x52, 0xd2, 0x53, 0x5f, 0x09, 0x1e, + 0x7b, 0x49, 0x0c, 0xf8, 0x00, 0x6f, 0x76, 0x15, 0xed, 0x7f, 0xaf, 0x00, 0xdb, 0x6b, 0x7b, 0xed, 0x24, 0x17, 0xed, 0xdd, 0x9b, 0x99, 0xf9, 0x66, 0x18, 0xbe, 0x19, 0x0f, 0x03, 0xf9, 0xb8, 0x91, + 0x65, 0xb2, 0x06, 0x63, 0x85, 0x56, 0x7f, 0x9e, 0x2c, 0xd1, 0xd9, 0xc9, 0x47, 0xba, 0x20, 0x95, 0xd1, 0x0f, 0xc0, 0x5d, 0xb2, 0xb1, 0xe2, 0xc2, 0xf2, 0x15, 0x48, 0x76, 0xa5, 0x39, 0x73, 0x01, + 0xb3, 0x72, 0xae, 0xba, 0xc0, 0x58, 0xb2, 0x35, 0x28, 0xc4, 0x2a, 0xc6, 0x57, 0x80, 0xb4, 0x29, 0xf0, 0xcd, 0x97, 0x6b, 0xfc, 0x2b, 0x3a, 0x43, 0x67, 0x89, 0x47, 0xd8, 0x29, 0xc8, 0xc6, 0x66, 0x51, 0x98, 0x06, 0x20, 0xda, 0xd8, 0xec, 0x24, 0xd9, 0xc8, 0x52, 0xd9, 0x37, 0xb8, 0x3d, 0x59, 0x24, 0x49, 0x12, 0xd1, 0x17, 0x1b, 0x2b, 0x3a, 0x8b, 0xa7, 0xa7, 0x27, 0xf4, 0x74, 0x1e, 0xb0, - 0xbf, 0x9d, 0x9d, 0x2d, 0xf1, 0x7f, 0xd7, 0x57, 0xb7, 0x21, 0xe4, 0x54, 0x28, 0xeb, 0x98, 0xe2, 0x70, 0x42, 0x17, 0x49, 0x42, 0xa4, 0xce, 0xa0, 0xfc, 0x16, 0x4f, 0x4a, 0x83, 0x47, 0x82, 0x07, + 0xbf, 0x9c, 0x9d, 0x2d, 0xf1, 0x7f, 0xd7, 0x57, 0xb7, 0x21, 0xe4, 0x54, 0x28, 0xeb, 0x98, 0xe2, 0x70, 0x42, 0x17, 0x49, 0x42, 0xa4, 0xce, 0xa0, 0xfc, 0x1a, 0x4f, 0x4a, 0x83, 0x47, 0x82, 0x07, 0x32, 0x0f, 0x2a, 0x8c, 0xae, 0xab, 0xcb, 0x8c, 0x6a, 0x53, 0x20, 0xc6, 0x25, 0x10, 0xdc, 0x4a, 0xbc, 0x96, 0x19, 0x27, 0x72, 0xc6, 0xdd, 0x65, 0x46, 0xf3, 0x5a, 0x71, 0xcf, 0x07, 0xc1, 0x3d, - 0xa1, 0xc7, 0x34, 0x5c, 0xd2, 0xa5, 0xdf, 0x21, 0xbd, 0xfd, 0xf2, 0xf9, 0xe6, 0xf6, 0x9f, 0xaf, 0x77, 0x04, 0xaf, 0x7b, 0xbb, 0x54, 0x46, 0x57, 0x60, 0x9c, 0x00, 0x4b, 0xc3, 0xa1, 0x08, 0xd7, - 0xb2, 0x12, 0x25, 0x98, 0xb4, 0x2a, 0xeb, 0x42, 0x28, 0xd4, 0x82, 0xcf, 0xd1, 0x47, 0xb4, 0x24, 0x78, 0x4e, 0x1d, 0x8d, 0x23, 0x65, 0x2d, 0x06, 0x19, 0x28, 0x81, 0x59, 0xa0, 0xcb, 0x25, 0xc1, - 0x33, 0xaa, 0x68, 0xd7, 0x24, 0x19, 0xdd, 0xd7, 0xa2, 0xcc, 0x90, 0xd5, 0xb5, 0xe1, 0xf0, 0x97, 0xe2, 0x3a, 0x13, 0xaa, 0xa0, 0xff, 0xde, 0xfd, 0x9d, 0x7e, 0x24, 0xf8, 0x45, 0xcc, 0xd0, 0x8d, - 0x81, 0x4a, 0x1b, 0x27, 0x54, 0x81, 0x74, 0xed, 0xaa, 0xda, 0xcd, 0xb9, 0x9a, 0xc5, 0x45, 0x77, 0xdf, 0x6b, 0x66, 0x1e, 0x6b, 0x8b, 0xaa, 0x92, 0xb9, 0x5c, 0x1b, 0x89, 0x5a, 0x7e, 0x53, 0x91, - 0xd1, 0x46, 0x99, 0xde, 0x6b, 0x49, 0xf0, 0x8b, 0xc8, 0x19, 0x67, 0x21, 0x9b, 0x5e, 0x2f, 0x34, 0x1a, 0x2b, 0x27, 0x3c, 0x76, 0xf0, 0x19, 0x77, 0xfb, 0x3c, 0x9d, 0x7f, 0xf0, 0x89, 0x9a, 0x05, - 0x44, 0x7b, 0xfb, 0x28, 0xaa, 0xcb, 0x3b, 0x4b, 0x9d, 0xa9, 0x81, 0xe0, 0x76, 0xd5, 0xe8, 0x6a, 0x03, 0xb9, 0x30, 0x70, 0x58, 0x02, 0xbe, 0x8e, 0xae, 0x3f, 0x10, 0x3c, 0x87, 0xf0, 0x15, 0x85, - 0x87, 0x25, 0x45, 0x32, 0xa8, 0x40, 0x65, 0xa0, 0xf8, 0xf6, 0x9a, 0x29, 0x56, 0x80, 0x04, 0xe5, 0x9a, 0x8d, 0x3a, 0x55, 0x57, 0x7e, 0x03, 0x7c, 0x2b, 0xea, 0xfd, 0x0c, 0xa7, 0xcf, 0xb3, 0xc4, - 0xec, 0x06, 0x3f, 0x48, 0x63, 0xd7, 0xfb, 0x23, 0x26, 0x4c, 0x7b, 0x59, 0xda, 0x8d, 0xff, 0x9e, 0xc6, 0x41, 0x7b, 0xb2, 0x09, 0xeb, 0x46, 0xb5, 0x1b, 0xfc, 0x50, 0x8d, 0x99, 0xdb, 0x56, 0x40, - 0x2b, 0x5f, 0x1a, 0xe1, 0x6b, 0xaf, 0xb0, 0x5c, 0x57, 0x40, 0x85, 0xf4, 0x85, 0x47, 0x70, 0x5c, 0xb5, 0x27, 0xc7, 0xe3, 0xa3, 0xf7, 0x24, 0x2d, 0x9b, 0x78, 0x8e, 0xce, 0x09, 0x32, 0x27, 0xa8, - 0xec, 0x88, 0xdc, 0x17, 0xdd, 0x01, 0x6d, 0x7d, 0xd2, 0xda, 0x2a, 0xcf, 0x6b, 0xf5, 0x7d, 0x9b, 0x3e, 0x2a, 0xe6, 0xc4, 0x1a, 0x52, 0x58, 0x83, 0x72, 0xf6, 0x90, 0xb1, 0x89, 0x13, 0x1c, 0x2f, - 0x04, 0x2b, 0x59, 0x59, 0x9a, 0x2d, 0xa4, 0x2b, 0x60, 0xa5, 0x5b, 0xfd, 0xe2, 0xdd, 0x99, 0xe1, 0xbf, 0x78, 0xc7, 0x87, 0x5a, 0x09, 0xf7, 0xc7, 0x54, 0x59, 0x36, 0x45, 0xe4, 0xc0, 0x0e, 0x4b, - 0xe8, 0x87, 0xc3, 0x31, 0x60, 0x5d, 0xca, 0xac, 0xff, 0x9b, 0xb3, 0x17, 0x63, 0x1a, 0x02, 0xdf, 0x1f, 0xd1, 0x44, 0x41, 0x87, 0x76, 0xde, 0xa0, 0x63, 0x37, 0xd9, 0xb7, 0x82, 0xb8, 0xa6, 0x47, - 0x6d, 0x03, 0x2d, 0xbd, 0xf1, 0xf2, 0x8f, 0x3b, 0x1c, 0xf7, 0xdf, 0x87, 0x8d, 0x03, 0xe5, 0x65, 0x6d, 0x77, 0xed, 0x09, 0xfa, 0x28, 0xe0, 0xb5, 0x1b, 0x0a, 0xfb, 0xe2, 0xbe, 0xd4, 0x9f, 0x5c, - 0xb3, 0xd2, 0x0e, 0x65, 0x8d, 0x94, 0x06, 0x06, 0x09, 0x0e, 0xdf, 0x93, 0x80, 0x02, 0x14, 0x18, 0xe6, 0x20, 0xe5, 0x3a, 0x83, 0x37, 0x03, 0x53, 0x9f, 0x4d, 0x3b, 0x05, 0x8f, 0xb2, 0x61, 0xdc, - 0x78, 0x22, 0xf0, 0x9e, 0x70, 0x9f, 0x53, 0x3c, 0x4c, 0xea, 0x61, 0x8e, 0x7b, 0xa9, 0x88, 0x39, 0x1a, 0x8d, 0x1c, 0xaf, 0x26, 0x6b, 0x66, 0x44, 0x99, 0xcc, 0x15, 0xd7, 0x2a, 0x17, 0x45, 0x6d, - 0xd8, 0x98, 0xf2, 0x6e, 0x0e, 0xfa, 0x6c, 0x8a, 0x11, 0xef, 0x84, 0x99, 0x82, 0xa6, 0x15, 0x33, 0x4c, 0x82, 0x03, 0x13, 0xfa, 0x60, 0x31, 0x24, 0x63, 0xda, 0xd8, 0xcb, 0x27, 0xb6, 0x7b, 0x07, - 0x25, 0xa3, 0xfb, 0xf7, 0x55, 0x4a, 0x66, 0xee, 0xeb, 0x1f, 0xa4, 0xc4, 0x6e, 0xad, 0x03, 0x79, 0x13, 0xaf, 0xf7, 0xed, 0x37, 0x66, 0x04, 0xbb, 0x2f, 0x61, 0xcc, 0xce, 0x03, 0x5b, 0x33, 0x54, - 0x3b, 0x51, 0xa2, 0x52, 0x17, 0x85, 0x1f, 0xae, 0x64, 0xb8, 0xa8, 0x4c, 0x98, 0x64, 0x1f, 0xee, 0xb5, 0xb5, 0x5e, 0xd3, 0x08, 0xd1, 0x95, 0x2e, 0xe2, 0x45, 0x66, 0x08, 0x9e, 0x37, 0x1d, 0x6e, - 0x11, 0x67, 0xc9, 0x95, 0x96, 0x40, 0x4f, 0x9f, 0xf7, 0x8b, 0x5d, 0x3b, 0x65, 0x06, 0xcd, 0x20, 0x21, 0xaf, 0x86, 0x7e, 0xbc, 0xdc, 0xe4, 0x4c, 0x94, 0x96, 0xe5, 0x3f, 0x25, 0x37, 0xc7, 0x6b, - 0x1a, 0x42, 0x39, 0x28, 0xe2, 0x59, 0xd3, 0xd8, 0xb6, 0xe7, 0xdb, 0xc2, 0x1a, 0x8c, 0xc8, 0xb7, 0x6f, 0xec, 0x04, 0x2f, 0x55, 0x50, 0xf2, 0xe6, 0x2a, 0x0a, 0xc8, 0x38, 0x6d, 0x20, 0x21, 0x59, - 0x01, 0xa8, 0x62, 0x6e, 0x45, 0x4f, 0x9f, 0x87, 0xaf, 0x80, 0x4c, 0x18, 0xe0, 0x4e, 0x9b, 0xed, 0x0e, 0x8f, 0x55, 0xb9, 0x50, 0xac, 0xfc, 0xc2, 0x24, 0xec, 0x52, 0x53, 0x2b, 0xe5, 0xcb, 0xeb, - 0xd0, 0xdf, 0xe1, 0x9e, 0x3f, 0xbf, 0x7a, 0x93, 0xf7, 0x54, 0x70, 0xf2, 0xb6, 0x2a, 0x4e, 0xe6, 0x2b, 0x39, 0xaa, 0xde, 0xd5, 0xa5, 0xdb, 0x55, 0x33, 0x81, 0x76, 0x37, 0xb6, 0x7f, 0x6f, 0xe5, - 0xa2, 0x0b, 0xa0, 0x5d, 0x76, 0x4e, 0x44, 0x46, 0x23, 0xe5, 0x04, 0x8b, 0xde, 0x58, 0xc1, 0x9d, 0x58, 0x8f, 0x42, 0x6b, 0x9f, 0xa1, 0xdb, 0x41, 0xb4, 0x8a, 0x49, 0xe8, 0x3c, 0x84, 0x45, 0x2f, - 0xe8, 0xb1, 0x05, 0xc1, 0x87, 0x8e, 0x0f, 0x5e, 0xb7, 0x41, 0xd8, 0x3e, 0x76, 0x72, 0x56, 0xda, 0xf1, 0xdb, 0x27, 0x00, 0xba, 0xdb, 0x9e, 0xf1, 0x47, 0x5f, 0x2a, 0x61, 0x84, 0x6f, 0xe3, 0x98, - 0x54, 0x2e, 0x46, 0x51, 0xed, 0x47, 0x70, 0xdc, 0x23, 0xa5, 0x5b, 0x58, 0xba, 0xe8, 0x1e, 0xa1, 0x74, 0xf1, 0x7f, 0x00, 0x00, 0x00, 0xff, 0xff, 0x50, 0x4b, 0x07, 0x08, 0x97, 0x9b, 0xfc, 0xbe, + 0xa1, 0xc7, 0x34, 0x5c, 0xd2, 0xa5, 0xdf, 0x21, 0xbd, 0xfd, 0xfc, 0xe9, 0xe6, 0xf6, 0x9f, 0x2f, 0x77, 0x04, 0xaf, 0x7b, 0xbb, 0x54, 0x46, 0x57, 0x60, 0x9c, 0x00, 0x4b, 0xc3, 0xa1, 0x08, 0xd7, + 0xb2, 0x12, 0x25, 0x98, 0xb4, 0x2a, 0xeb, 0x42, 0x28, 0xd4, 0x82, 0xcf, 0xd1, 0x07, 0xb4, 0x24, 0x78, 0x4e, 0x1d, 0x8d, 0x23, 0x65, 0x2d, 0x06, 0x19, 0x28, 0x81, 0x59, 0xa0, 0xcb, 0x25, 0xc1, + 0x33, 0xaa, 0x68, 0xd7, 0x24, 0x19, 0xdd, 0xd7, 0xa2, 0xcc, 0x90, 0xd5, 0xb5, 0xe1, 0xf0, 0x97, 0xe2, 0x3a, 0x13, 0xaa, 0xa0, 0xff, 0xde, 0xfd, 0x9d, 0x7e, 0x20, 0xf8, 0x45, 0xcc, 0xd0, 0x8d, + 0x81, 0x4a, 0x1b, 0x27, 0x54, 0x81, 0x74, 0xed, 0xaa, 0xda, 0xcd, 0xb9, 0x9a, 0xc5, 0x45, 0x77, 0xdf, 0x6a, 0x66, 0x1e, 0x6b, 0x8b, 0xaa, 0x92, 0xb9, 0x5c, 0x1b, 0x89, 0x5a, 0x7e, 0x53, 0x91, + 0xd1, 0x46, 0x99, 0xde, 0x6b, 0x49, 0xf0, 0x8b, 0xc8, 0x19, 0x67, 0x21, 0x9b, 0x5e, 0x2f, 0x34, 0x1a, 0x2b, 0x27, 0x3c, 0x76, 0xf0, 0x19, 0x77, 0xfb, 0x3c, 0x9d, 0xff, 0xe1, 0x13, 0x35, 0x0b, + 0x88, 0xf6, 0xf6, 0x51, 0x54, 0x97, 0x77, 0x96, 0x3a, 0x53, 0x03, 0xc1, 0xed, 0xaa, 0xd1, 0xd5, 0x06, 0x72, 0x61, 0xe0, 0xb0, 0x04, 0x7c, 0x1d, 0x5d, 0xff, 0x4e, 0xf0, 0x1c, 0xc2, 0x57, 0x14, + 0x1e, 0x96, 0x14, 0xc9, 0xa0, 0x02, 0x95, 0x81, 0xe2, 0xdb, 0x6b, 0xa6, 0x58, 0x01, 0x12, 0x94, 0x6b, 0x36, 0xea, 0x54, 0x5d, 0xf9, 0x0d, 0xf0, 0xad, 0xa8, 0xf7, 0x33, 0x9c, 0x3e, 0xcf, 0x12, + 0xb3, 0x1b, 0xfc, 0x20, 0x8d, 0x5d, 0xef, 0x8f, 0x98, 0x30, 0xed, 0x65, 0x69, 0x37, 0xfe, 0x7b, 0x1a, 0x07, 0xed, 0xc9, 0x26, 0xac, 0x1b, 0xd5, 0x6e, 0xf0, 0x43, 0x35, 0x66, 0x6e, 0x5b, 0x01, + 0xad, 0x7c, 0x69, 0x84, 0xaf, 0xbd, 0xc2, 0x72, 0x5d, 0x01, 0x15, 0xd2, 0x17, 0x1e, 0xc1, 0x71, 0xd5, 0x9e, 0x1c, 0x8f, 0x8f, 0xde, 0x93, 0xb4, 0x6c, 0xe2, 0x39, 0x3a, 0x27, 0xc8, 0x9c, 0xa0, + 0xb2, 0x23, 0x72, 0x5f, 0x74, 0x07, 0xb4, 0xf5, 0x49, 0x6b, 0xab, 0x3c, 0xaf, 0xd5, 0xb7, 0x6d, 0xfa, 0xa8, 0x98, 0x13, 0x6b, 0x48, 0x61, 0x0d, 0xca, 0xd9, 0x43, 0xc6, 0x26, 0x4e, 0x70, 0xbc, + 0x10, 0xac, 0x64, 0x65, 0x69, 0xb6, 0x90, 0xae, 0x80, 0x95, 0x6e, 0xf5, 0x93, 0x77, 0x67, 0x86, 0xff, 0xe4, 0x1d, 0x1f, 0x6a, 0x25, 0xdc, 0x6f, 0x53, 0x65, 0xd9, 0x14, 0x91, 0x03, 0x3b, 0x2c, + 0xa1, 0xef, 0x0e, 0xc7, 0x80, 0x75, 0x29, 0xb3, 0xfe, 0x6f, 0xce, 0x5e, 0x8c, 0x69, 0x08, 0x7c, 0x7f, 0x44, 0x13, 0x05, 0x1d, 0xda, 0x79, 0x83, 0x8e, 0xdd, 0x64, 0xdf, 0x0a, 0xe2, 0x9a, 0x1e, + 0xb5, 0x0d, 0xb4, 0xf4, 0xc6, 0xcb, 0x3f, 0xee, 0x70, 0xdc, 0x7f, 0x1f, 0x36, 0x0e, 0x94, 0x97, 0xb5, 0xdd, 0xb5, 0x27, 0xe8, 0xa3, 0x80, 0xd7, 0x6e, 0x28, 0xec, 0x8b, 0xfb, 0x52, 0x7f, 0x72, + 0xcd, 0x4a, 0x3b, 0x94, 0x35, 0x52, 0x1a, 0x18, 0x24, 0x38, 0x7c, 0x4f, 0x02, 0x0a, 0x50, 0x60, 0x98, 0x83, 0x94, 0xeb, 0x0c, 0xde, 0x0c, 0x4c, 0x7d, 0x36, 0xed, 0x14, 0x3c, 0xca, 0x86, 0x71, + 0xe3, 0x89, 0xc0, 0x7b, 0xc2, 0x7d, 0x4e, 0xf1, 0x30, 0xa9, 0x87, 0x39, 0xee, 0xa5, 0x22, 0xe6, 0x68, 0x34, 0x72, 0xbc, 0x9a, 0xac, 0x99, 0x11, 0x65, 0x32, 0x57, 0x5c, 0xab, 0x5c, 0x14, 0xb5, + 0x61, 0x63, 0xca, 0xbb, 0x39, 0xe8, 0x93, 0x29, 0x46, 0xbc, 0x13, 0x66, 0x0a, 0x9a, 0x56, 0xcc, 0x30, 0x09, 0x0e, 0x4c, 0xe8, 0x83, 0xc5, 0x90, 0x8c, 0x69, 0x63, 0x2f, 0x9f, 0xd8, 0xee, 0x1d, + 0x94, 0x8c, 0xee, 0xdf, 0x57, 0x29, 0x99, 0xb9, 0xaf, 0xbf, 0x93, 0x12, 0xbb, 0xb5, 0x0e, 0xe4, 0x4d, 0xbc, 0xde, 0xb7, 0x5f, 0x99, 0x11, 0xec, 0xbe, 0x84, 0x31, 0x3b, 0x0f, 0x6c, 0xcd, 0x50, + 0xed, 0x44, 0x89, 0x4a, 0x5d, 0x14, 0x7e, 0xb8, 0x92, 0xe1, 0xa2, 0x32, 0x61, 0x92, 0x7d, 0xb8, 0xd7, 0xd6, 0x7a, 0x4d, 0x23, 0x44, 0x57, 0xba, 0x88, 0x17, 0x99, 0x21, 0x78, 0xde, 0x74, 0xb8, + 0x45, 0x9c, 0x25, 0x57, 0x5a, 0x02, 0x3d, 0x7d, 0xde, 0x2f, 0x76, 0xed, 0x94, 0x19, 0x34, 0x83, 0x84, 0xbc, 0x1a, 0xfa, 0xf1, 0x72, 0x93, 0x33, 0x51, 0x5a, 0x96, 0xff, 0x90, 0xdc, 0x1c, 0xaf, + 0x69, 0x08, 0xe5, 0xa0, 0x88, 0x67, 0x4d, 0x63, 0xdb, 0x9e, 0x6f, 0x0b, 0x6b, 0x30, 0x22, 0xdf, 0xbe, 0xb1, 0x13, 0xbc, 0x54, 0x41, 0xc9, 0x9b, 0xab, 0x28, 0x20, 0xe3, 0xb4, 0x81, 0x84, 0x64, + 0x05, 0xa0, 0x8a, 0xb9, 0x15, 0x3d, 0x7d, 0x1e, 0xbe, 0x02, 0x32, 0x61, 0x80, 0x3b, 0x6d, 0xb6, 0x3b, 0x3c, 0x56, 0xe5, 0x42, 0xb1, 0xf2, 0x33, 0x93, 0xb0, 0x4b, 0x4d, 0xad, 0x94, 0x2f, 0xaf, + 0x43, 0x7f, 0x87, 0x7b, 0xfe, 0xf8, 0xea, 0x4d, 0xde, 0x53, 0xc1, 0xc9, 0xdb, 0xaa, 0x38, 0x99, 0xaf, 0xe4, 0xa8, 0x7a, 0x57, 0x97, 0x6e, 0x57, 0xcd, 0x04, 0xda, 0xdd, 0xd8, 0xfe, 0xbd, 0x95, + 0x8b, 0x2e, 0x80, 0x76, 0xd9, 0x39, 0x11, 0x19, 0x8d, 0x94, 0x13, 0x2c, 0x7a, 0x63, 0x05, 0x77, 0x62, 0x3d, 0x0a, 0xad, 0x7d, 0x86, 0x6e, 0x07, 0xd1, 0x2a, 0x26, 0xa1, 0xf3, 0x10, 0x16, 0xbd, + 0xa0, 0xc7, 0x16, 0x04, 0x1f, 0x3a, 0x3e, 0x78, 0xdd, 0x06, 0x61, 0xfb, 0xd8, 0xc9, 0x59, 0x69, 0xc7, 0x6f, 0x9f, 0x00, 0xe8, 0x6e, 0x7b, 0xc6, 0x1f, 0x7d, 0xa9, 0x84, 0x11, 0xbe, 0x8d, 0x63, + 0x52, 0xb9, 0x18, 0x45, 0xb5, 0x1f, 0xc1, 0x71, 0x8f, 0x94, 0x6e, 0x61, 0xe9, 0xa2, 0x7b, 0x84, 0xd2, 0xc5, 0xff, 0x01, 0x00, 0x00, 0xff, 0xff, 0x50, 0x4b, 0x07, 0x08, 0x7b, 0x3e, 0x7e, 0x8a, 0xf9, 0x03, 0x00, 0x00, 0xf9, 0x10, 0x00, 0x00, 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00, 0x71, 0x75, 0x61, 0x72, 0x6b, 0x75, 0x73, 0x2f, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x73, 0x72, 0x63, 0x2f, 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x16, 0x00, 0x00, 0x00, 0x71, 0x75, 0x61, 0x72, 0x6b, 0x75, 0x73, 0x2f, 0x68, 0x74, 0x74, @@ -13660,7 +13660,7 @@ var TemplatesZip = []byte{ 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2f, 0x6d, 0x76, 0x6e, 0x77, 0x50, 0x4b, 0x01, 0x02, 0x14, 0x03, 0x14, 0x00, 0x08, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x68, 0x33, 0xee, 0xa3, 0xf6, 0x0a, 0x00, 0x00, 0xa7, 0x1d, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xed, 0x81, 0x6b, 0x6a, 0x03, 0x00, 0x71, 0x75, 0x61, 0x72, 0x6b, 0x75, 0x73, 0x2f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2f, 0x6d, 0x76, 0x6e, 0x77, 0x2e, 0x63, 0x6d, 0x64, 0x50, 0x4b, 0x01, 0x02, 0x14, 0x03, - 0x14, 0x00, 0x08, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x97, 0x9b, 0xfc, 0xbe, 0xf9, 0x03, 0x00, 0x00, 0xf9, 0x10, 0x00, 0x00, 0x1b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x14, 0x00, 0x08, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x7b, 0x3e, 0x7e, 0x8a, 0xf9, 0x03, 0x00, 0x00, 0xf9, 0x10, 0x00, 0x00, 0x1b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xa4, 0x81, 0xab, 0x75, 0x03, 0x00, 0x71, 0x75, 0x61, 0x72, 0x6b, 0x75, 0x73, 0x2f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2f, 0x70, 0x6f, 0x6d, 0x2e, 0x78, 0x6d, 0x6c, 0x50, 0x4b, 0x01, 0x02, 0x14, 0x03, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xed, 0x81, 0xed, 0x79, 0x03, 0x00, 0x71, 0x75, 0x61, 0x72, 0x6b, 0x75, 0x73, 0x2f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x65, 0x76, @@ -13722,8 +13722,8 @@ var TemplatesZip = []byte{ 0x61, 0x0e, 0x00, 0x00, 0x19, 0x2c, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xed, 0x81, 0x54, 0x91, 0x03, 0x00, 0x71, 0x75, 0x61, 0x72, 0x6b, 0x75, 0x73, 0x2f, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x6d, 0x76, 0x6e, 0x77, 0x50, 0x4b, 0x01, 0x02, 0x14, 0x03, 0x14, 0x00, 0x08, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x68, 0x33, 0xee, 0xa3, 0xf6, 0x0a, 0x00, 0x00, 0xa7, 0x1d, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xed, 0x81, 0xf4, 0x9f, 0x03, 0x00, 0x71, 0x75, 0x61, 0x72, 0x6b, 0x75, 0x73, - 0x2f, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x6d, 0x76, 0x6e, 0x77, 0x2e, 0x63, 0x6d, 0x64, 0x50, 0x4b, 0x01, 0x02, 0x14, 0x03, 0x14, 0x00, 0x08, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x97, 0x9b, - 0xfc, 0xbe, 0xf9, 0x03, 0x00, 0x00, 0xf9, 0x10, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xa4, 0x81, 0x2d, 0xab, 0x03, 0x00, 0x71, 0x75, 0x61, 0x72, + 0x2f, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x6d, 0x76, 0x6e, 0x77, 0x2e, 0x63, 0x6d, 0x64, 0x50, 0x4b, 0x01, 0x02, 0x14, 0x03, 0x14, 0x00, 0x08, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x7b, 0x3e, + 0x7e, 0x8a, 0xf9, 0x03, 0x00, 0x00, 0xf9, 0x10, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xa4, 0x81, 0x2d, 0xab, 0x03, 0x00, 0x71, 0x75, 0x61, 0x72, 0x6b, 0x75, 0x73, 0x2f, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x70, 0x6f, 0x6d, 0x2e, 0x78, 0x6d, 0x6c, 0x50, 0x4b, 0x01, 0x02, 0x14, 0x03, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xed, 0x81, 0x68, 0xaf, 0x03, 0x00, 0x71, 0x75, 0x61, 0x72, 0x6b, 0x75, 0x73, 0x2f, 0x68, 0x74, 0x74, 0x70, 0x2f, 0x73, 0x72, 0x63, 0x2f, 0x50, 0x4b, 0x01, 0x02, 0x14, 0x03, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, diff --git a/templates/quarkus/cloudevents/pom.xml b/templates/quarkus/cloudevents/pom.xml index 1225886717..5d5b1f5fc9 100644 --- a/templates/quarkus/cloudevents/pom.xml +++ b/templates/quarkus/cloudevents/pom.xml @@ -12,7 +12,7 @@ UTF-8 quarkus-bom io.quarkus.platform - 3.37.1 + 3.39.1 true 3.0.0-M7 diff --git a/templates/quarkus/http/pom.xml b/templates/quarkus/http/pom.xml index 1225886717..5d5b1f5fc9 100644 --- a/templates/quarkus/http/pom.xml +++ b/templates/quarkus/http/pom.xml @@ -12,7 +12,7 @@ UTF-8 quarkus-bom io.quarkus.platform - 3.37.1 + 3.39.1 true 3.0.0-M7 From 6aeaaa5267f996d8ea841c1da646e65c9f98a3af Mon Sep 17 00:00:00 2001 From: David Fridrich Date: Wed, 5 Aug 2026 18:18:20 +0200 Subject: [PATCH 05/38] UPSTREAM: : Replace OWNERS with OpenShift downstream maintainers --- OWNERS | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/OWNERS b/OWNERS index 478bf2b296..5f8d620b84 100644 --- a/OWNERS +++ b/OWNERS @@ -1,13 +1,9 @@ -# The OWNERS file is used by prow to automatically merge approved PRs. - approvers: -- technical-oversight-committee -- knative-release-leads -- client-writers -- func-writers -- functions-wg-leads + - gauron99 + - perdasilva + - maschmid reviewers: -- client-writers -- func-reviewers - + - gauron99 + - perdasilva + - maschmid From 4cee4fe1c0854a244b9bc3923c635226ebb018e6 Mon Sep 17 00:00:00 2001 From: David Fridrich Date: Wed, 5 Aug 2026 18:25:42 +0200 Subject: [PATCH 06/38] UPSTREAM: : Add post-rebase-hook to remove .github and OWNERS_ALIASES --- hack/openshift/post-rebase-hook.sh | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100755 hack/openshift/post-rebase-hook.sh diff --git a/hack/openshift/post-rebase-hook.sh b/hack/openshift/post-rebase-hook.sh new file mode 100755 index 0000000000..b3b0d9094d --- /dev/null +++ b/hack/openshift/post-rebase-hook.sh @@ -0,0 +1,15 @@ +#!/bin/bash +# Post-rebase cleanup for OpenShift downstream + +# Remove upstream GitHub Actions/Dependabot (disabled in OpenShift org) +rm -rf .github + +# Remove upstream OWNERS_ALIASES (knative team aliases don't resolve in OpenShift Prow) +rm -f OWNERS_ALIASES + +# Remove ko config (upstream CI only, downstream uses Konflux) +rm -f .ko.yaml + +git add -A +# only commit if there are staged changes (no-op if already absent) +git diff --cached --quiet || git commit -m "UPSTREAM: : Remove upstream-only files not used in OpenShift org" From 5ac4865ebb9bc59fadd1bd3057ce132a29d6534e Mon Sep 17 00:00:00 2001 From: David Fridrich Date: Wed, 5 Aug 2026 19:21:42 +0200 Subject: [PATCH 07/38] UPSTREAM: : Default builder to s2i for OpenShift --- pkg/builders/builders.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/builders/builders.go b/pkg/builders/builders.go index 894177fffe..e16f18ba4b 100644 --- a/pkg/builders/builders.go +++ b/pkg/builders/builders.go @@ -16,7 +16,7 @@ const ( Host = "host" Pack = "pack" S2I = "s2i" - Default = Pack + Default = S2I ) // Known builder names with a pretty-printed string representation From 6cd85183f005645c6c4c689405814d80285add5c Mon Sep 17 00:00:00 2001 From: David Fridrich Date: Wed, 5 Aug 2026 19:21:57 +0200 Subject: [PATCH 08/38] UPSTREAM: : Use Red Hat buildah image for s2i pipeline task --- pkg/pipelines/tekton/task-s2i.yaml.tmpl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/pipelines/tekton/task-s2i.yaml.tmpl b/pkg/pipelines/tekton/task-s2i.yaml.tmpl index c739a45a1f..53e9ba8615 100644 --- a/pkg/pipelines/tekton/task-s2i.yaml.tmpl +++ b/pkg/pipelines/tekton/task-s2i.yaml.tmpl @@ -108,7 +108,7 @@ spec: - mountPath: /env-vars name: env-vars - name: build - image: quay.io/buildah/stable:v1.31.0 + image: registry.redhat.io/rhel9/buildah@sha256:df8acdf534d99fc7992a3307a2bf584391991e0b56fd9f53b27e2608debe8d1c workingDir: /gen-source script: | TLS_VERIFY_FLAG="" From f425a35406c10f5d3d133ce2a489974045cda038 Mon Sep 17 00:00:00 2001 From: Marek Schmidt Date: Mon, 10 Aug 2026 16:59:41 +0200 Subject: [PATCH 09/38] utils Dockerfiles for Konflux --- Dockerfile.utils.rhel9 | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100755 Dockerfile.utils.rhel9 diff --git a/Dockerfile.utils.rhel9 b/Dockerfile.utils.rhel9 new file mode 100755 index 0000000000..b2071f7cf2 --- /dev/null +++ b/Dockerfile.utils.rhel9 @@ -0,0 +1,29 @@ +ARG GO_BUILDER=registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.26-openshift-5.0 +ARG GO_RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal + +FROM $GO_BUILDER as builder + +WORKDIR /workspace +COPY . . + +ENV CGO_ENABLED=1 +ENV GOEXPERIMENT=strictfipsruntime +ENV GOFLAGS='' + +RUN go build -tags strictfipsruntime,exclude_graphdriver_btrfs -o /usr/bin/main ./cmd/func-util + +FROM $GO_RUNTIME + +RUN microdnf install -y socat tar + +COPY --from=builder /usr/bin/main /usr/bin/func-util +COPY LICENSE /licenses/ + +RUN ln -s /usr/bin/func-util /usr/local/bin/deploy && \ + ln -s /usr/bin/func-util /usr/local/bin/scaffold && \ + ln -s /usr/bin/func-util /usr/local/bin/s2i && \ + ln -s /usr/bin/func-util /usr/local/bin/s2i-generate + +USER 65532 + +ENTRYPOINT ["/usr/bin/bash"] From eb615cf19a8e5d39316bc382b292a816babf45aa Mon Sep 17 00:00:00 2001 From: "red-hat-konflux-kflux-prd-rh02[bot]" <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 09:42:18 +0000 Subject: [PATCH 10/38] Red Hat Konflux kflux-prd-rh02 update functions-utils Signed-off-by: red-hat-konflux-kflux-prd-rh02[bot] <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> --- .tekton/functions-utils-pull-request.yaml | 581 ++++++++++++++++++++++ .tekton/functions-utils-push.yaml | 578 +++++++++++++++++++++ 2 files changed, 1159 insertions(+) create mode 100644 .tekton/functions-utils-pull-request.yaml create mode 100644 .tekton/functions-utils-push.yaml diff --git a/.tekton/functions-utils-pull-request.yaml b/.tekton/functions-utils-pull-request.yaml new file mode 100644 index 0000000000..7665164340 --- /dev/null +++ b/.tekton/functions-utils-pull-request.yaml @@ -0,0 +1,581 @@ +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + annotations: + build.appstudio.openshift.io/repo: https://github.com/openshift/functions?rev={{revision}} + build.appstudio.redhat.com/commit_sha: '{{revision}}' + build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' + build.appstudio.redhat.com/target_branch: '{{target_branch}}' + pipelinesascode.tekton.dev/cancel-in-progress: "true" + pipelinesascode.tekton.dev/max-keep-runs: "3" + pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch + == "main" + labels: + appstudio.openshift.io/application: serverless-functions + appstudio.openshift.io/component: functions-utils + pipelines.appstudio.openshift.io/type: build + name: functions-utils-on-pull-request + namespace: ocp-serverless-tenant +spec: + params: + - name: git-url + value: '{{source_url}}' + - name: revision + value: '{{revision}}' + - name: output-image + value: quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils:on-pr-{{revision}} + - name: image-expires-after + value: 5d + - name: build-platforms + value: + - linux/x86_64 + - name: dockerfile + value: ./Dockerfile.utils.rhel9 + pipelineSpec: + description: | + This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. + + _Uses `buildah` to create a multi-platform container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. This pipeline requires that the [multi platform controller](https://github.com/konflux-ci/multi-platform-controller) is deployed and configured on your Konflux instance. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://conforma.dev/docs/policy/packages/release_trusted_task.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks. + This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-multi-platform-oci-ta?tab=tags)_ + params: + - description: Source Repository URL + name: git-url + type: string + - default: "" + description: Revision of the Source Repository + name: revision + type: string + - description: Fully Qualified Output Image + name: output-image + type: string + - default: . + description: Path to the source code of an application's component from where + to build image. + name: path-context + type: string + - default: Dockerfile + description: Path to the Dockerfile inside the context specified by parameter + path-context + name: dockerfile + type: string + - default: "false" + description: Skip checks against built image + name: skip-checks + type: string + - default: "false" + description: Execute the build with network isolation + name: hermetic + type: string + - default: "" + description: Build dependencies to be prefetched + name: prefetch-input + type: string + - default: "" + description: Image tag expiration time, time values could be something like + 1h, 2d, 3w for hours, days, and weeks, respectively. + name: image-expires-after + type: string + - default: "false" + description: Build a source image. + name: build-source-image + type: string + - default: "true" + description: Add built image into an OCI image index + name: build-image-index + type: string + - default: docker + description: The format for the resulting image's mediaType. Valid values are + oci or docker. + name: buildah-format + type: string + - default: "false" + description: Enable cache proxy configuration + name: enable-cache-proxy + - default: "true" + description: Use the package registry proxy when prefetching dependencies + name: enable-package-registry-proxy + - default: . + description: Target directories in component's source code to scan with SAST + tools. Multiple values should be separated with commas. + name: sast-target-dirs + type: string + - default: [] + description: Array of --build-arg values ("arg=value" strings) for buildah + name: build-args + type: array + - default: "" + description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file + name: build-args-file + type: string + - default: "false" + description: Whether to enable privileged mode, should be used only with remote + VMs + name: privileged-nested + type: string + - default: "" + description: Sets the image created time and the SOURCE_DATE_EPOCH build argument. + On its own, it does not change file timestamps inside the layers (set rewrite-timestamp + to "true" for that). Leave empty to keep the actual build time. + name: source-date-epoch + type: string + - default: "false" + description: When "true", clamp file modification times in the image layers + to at most source-date-epoch. Does nothing unless source-date-epoch is set. + name: rewrite-timestamp + type: string + - default: "false" + description: When "true", omit the build history (history timestamps, layer + metadata, etc.) from the resulting image. + name: omit-history + type: string + - default: + - linux/x86_64 + description: List of platforms to build the container images on. The available + set of values is determined by the configuration of the multi-platform-controller. + name: build-platforms + type: array + results: + - description: "" + name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - description: "" + name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - description: "" + name: CHAINS-GIT_URL + value: $(tasks.clone-repository.results.url) + - description: "" + name: CHAINS-GIT_COMMIT + value: $(tasks.clone-repository.results.commit) + tasks: + - name: init + params: + - name: enable-cache-proxy + value: $(params.enable-cache-proxy) + taskRef: + params: + - name: name + value: init + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.2@sha256:421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db + - name: kind + value: task + resolver: bundles + - name: clone-repository + params: + - name: url + value: $(params.git-url) + - name: revision + value: $(params.revision) + - name: ociStorage + value: $(params.output-image).git + - name: ociArtifactExpiresAfter + value: $(params.image-expires-after) + runAfter: + - init + taskRef: + params: + - name: name + value: git-clone-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.4@sha256:df3c42d78223f07b40a84dd29e5c8860d14777ffdf150ea08c738770f51216dc + - name: kind + value: task + resolver: bundles + workspaces: + - name: basic-auth + workspace: git-auth + - name: prefetch-dependencies + params: + - name: input + value: $(params.prefetch-input) + - name: enable-package-registry-proxy + value: $(params.enable-package-registry-proxy) + - name: SOURCE_ARTIFACT + value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) + - name: ociStorage + value: $(params.output-image).prefetch + - name: ociArtifactExpiresAfter + value: $(params.image-expires-after) + runAfter: + - clone-repository + taskRef: + params: + - name: name + value: prefetch-dependencies-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3.2@sha256:389aea03a065e8118d36b7acb85b05cd13f6750e7e10ff8a85f270ee65b0167b + - name: kind + value: task + resolver: bundles + workspaces: + - name: git-basic-auth + workspace: git-auth + - name: netrc + workspace: netrc + - matrix: + params: + - name: PLATFORM + value: + - $(params.build-platforms) + name: build-images + params: + - name: IMAGE + value: $(params.output-image) + - name: DOCKERFILE + value: $(params.dockerfile) + - name: CONTEXT + value: $(params.path-context) + - name: HERMETIC + value: $(params.hermetic) + - name: PREFETCH_INPUT + value: $(params.prefetch-input) + - name: IMAGE_EXPIRES_AFTER + value: $(params.image-expires-after) + - name: COMMIT_SHA + value: $(tasks.clone-repository.results.commit) + - name: BUILD_ARGS + value: + - $(params.build-args[*]) + - name: BUILD_ARGS_FILE + value: $(params.build-args-file) + - name: PRIVILEGED_NESTED + value: $(params.privileged-nested) + - name: SOURCE_URL + value: $(tasks.clone-repository.results.url) + - name: BUILDAH_FORMAT + value: $(params.buildah-format) + - name: HTTP_PROXY + value: $(tasks.init.results.http-proxy) + - name: NO_PROXY + value: $(tasks.init.results.no-proxy) + - name: SOURCE_DATE_EPOCH + value: $(params.source-date-epoch) + - name: REWRITE_TIMESTAMP + value: $(params.rewrite-timestamp) + - name: OMIT_HISTORY + value: $(params.omit-history) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + - name: IMAGE_APPEND_PLATFORM + value: "true" + runAfter: + - prefetch-dependencies + taskRef: + params: + - name: name + value: buildah-remote-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.10.5@sha256:eb277ec7b44443f0506a60ac940a2e52178d60f17cb0f51a6966daed5b3755de + - name: kind + value: task + resolver: bundles + - name: build-image-index + params: + - name: IMAGE + value: $(params.output-image) + - name: ALWAYS_BUILD_INDEX + value: $(params.build-image-index) + - name: IMAGES + value: + - $(tasks.build-images.results.IMAGE_REF[*]) + - name: BUILDAH_FORMAT + value: $(params.buildah-format) + runAfter: + - build-images + taskRef: + params: + - name: name + value: build-image-index + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:cc75f64deecccb1b59e96ac1182665a5342d79c9e22eebff63d26b0f00a4319c + - name: kind + value: task + resolver: bundles + - name: build-source-image + params: + - name: BINARY_IMAGE + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: BINARY_IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: source-build-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:7c5575ac8e292f27f57716c021ab0324460dc958e73946724c588c5228e5f372 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.build-source-image) + operator: in + values: + - "true" + - name: deprecated-base-image-check + params: + - name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: deprecated-image-check + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:0ccc688a77e9b7b0b8973c132a1e840844137e77f887be4a0bec8893b0776872 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - matrix: + params: + - name: image-platform + value: + - $(params.build-platforms) + name: clair-scan + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: clair-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:f5b4415db9ac1fba3e11d993a617e0b275d1f0ed2fc669b12c400ed848c39174 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - matrix: + params: + - name: platform + value: + - $(params.build-platforms) + name: ecosystem-cert-preflight-checks + params: + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: ecosystem-cert-preflight-checks + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:42720a1e9ed1ef75b615a03e521d01e3ce7ca67c995366a374a58e1307986c58 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-snyk-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: TARGET_DIRS + value: $(params.sast-target-dirs) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-snyk-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:eba24f5d9f4b18aa71e523b9b3dbcf22982aa4b018824260a090b19dfc9abf6f + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - matrix: + params: + - name: image-arch + value: + - $(params.build-platforms) + name: clamav-scan + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: clamav-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-shell-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: TARGET_DIRS + value: $(params.sast-target-dirs) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-shell-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:61b27e6ad5daba761d41bb37efb790ed98380603fd4fe2f86d156def5bd72ecc + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-unicode-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: TARGET_DIRS + value: $(params.sast-target-dirs) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-unicode-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:eb9d5392f215cb8b52b16382098cac4885b1e6cd989f88ebd83fdb234d283eb9 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: apply-tags + params: + - name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: apply-tags + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:3ab844157eccd68e95e4852adc06c3c4ea674edb7865a474b0a898227f2893d6 + - name: kind + value: task + resolver: bundles + - name: push-dockerfile + params: + - name: IMAGE + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: DOCKERFILE + value: $(params.dockerfile) + - name: CONTEXT + value: $(params.path-context) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: push-dockerfile-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:5a6cbebd89e5bc163b38231859767f7f6a0dd66cf1333699574379f062731183 + - name: kind + value: task + resolver: bundles + - name: rpms-signature-scan + params: + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: rpms-signature-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cc5133504ff03909ae970db81a986cb25a5532b2faf62a8ede5c60f28b716f54 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + workspaces: + - name: git-auth + optional: true + - name: netrc + optional: true + taskRunTemplate: + serviceAccountName: build-pipeline-functions-utils + workspaces: + - name: git-auth + secret: + secretName: '{{ git_auth_secret }}' +status: {} diff --git a/.tekton/functions-utils-push.yaml b/.tekton/functions-utils-push.yaml new file mode 100644 index 0000000000..a2cd95c02c --- /dev/null +++ b/.tekton/functions-utils-push.yaml @@ -0,0 +1,578 @@ +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + annotations: + build.appstudio.openshift.io/repo: https://github.com/openshift/functions?rev={{revision}} + build.appstudio.redhat.com/commit_sha: '{{revision}}' + build.appstudio.redhat.com/target_branch: '{{target_branch}}' + pipelinesascode.tekton.dev/cancel-in-progress: "false" + pipelinesascode.tekton.dev/max-keep-runs: "3" + pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch + == "main" + labels: + appstudio.openshift.io/application: serverless-functions + appstudio.openshift.io/component: functions-utils + pipelines.appstudio.openshift.io/type: build + name: functions-utils-on-push + namespace: ocp-serverless-tenant +spec: + params: + - name: git-url + value: '{{source_url}}' + - name: revision + value: '{{revision}}' + - name: output-image + value: quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils:{{revision}} + - name: build-platforms + value: + - linux/x86_64 + - name: dockerfile + value: ./Dockerfile.utils.rhel9 + pipelineSpec: + description: | + This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. + + _Uses `buildah` to create a multi-platform container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. This pipeline requires that the [multi platform controller](https://github.com/konflux-ci/multi-platform-controller) is deployed and configured on your Konflux instance. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://conforma.dev/docs/policy/packages/release_trusted_task.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks. + This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-multi-platform-oci-ta?tab=tags)_ + params: + - description: Source Repository URL + name: git-url + type: string + - default: "" + description: Revision of the Source Repository + name: revision + type: string + - description: Fully Qualified Output Image + name: output-image + type: string + - default: . + description: Path to the source code of an application's component from where + to build image. + name: path-context + type: string + - default: Dockerfile + description: Path to the Dockerfile inside the context specified by parameter + path-context + name: dockerfile + type: string + - default: "false" + description: Skip checks against built image + name: skip-checks + type: string + - default: "false" + description: Execute the build with network isolation + name: hermetic + type: string + - default: "" + description: Build dependencies to be prefetched + name: prefetch-input + type: string + - default: "" + description: Image tag expiration time, time values could be something like + 1h, 2d, 3w for hours, days, and weeks, respectively. + name: image-expires-after + type: string + - default: "false" + description: Build a source image. + name: build-source-image + type: string + - default: "true" + description: Add built image into an OCI image index + name: build-image-index + type: string + - default: docker + description: The format for the resulting image's mediaType. Valid values are + oci or docker. + name: buildah-format + type: string + - default: "false" + description: Enable cache proxy configuration + name: enable-cache-proxy + - default: "true" + description: Use the package registry proxy when prefetching dependencies + name: enable-package-registry-proxy + - default: . + description: Target directories in component's source code to scan with SAST + tools. Multiple values should be separated with commas. + name: sast-target-dirs + type: string + - default: [] + description: Array of --build-arg values ("arg=value" strings) for buildah + name: build-args + type: array + - default: "" + description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file + name: build-args-file + type: string + - default: "false" + description: Whether to enable privileged mode, should be used only with remote + VMs + name: privileged-nested + type: string + - default: "" + description: Sets the image created time and the SOURCE_DATE_EPOCH build argument. + On its own, it does not change file timestamps inside the layers (set rewrite-timestamp + to "true" for that). Leave empty to keep the actual build time. + name: source-date-epoch + type: string + - default: "false" + description: When "true", clamp file modification times in the image layers + to at most source-date-epoch. Does nothing unless source-date-epoch is set. + name: rewrite-timestamp + type: string + - default: "false" + description: When "true", omit the build history (history timestamps, layer + metadata, etc.) from the resulting image. + name: omit-history + type: string + - default: + - linux/x86_64 + description: List of platforms to build the container images on. The available + set of values is determined by the configuration of the multi-platform-controller. + name: build-platforms + type: array + results: + - description: "" + name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - description: "" + name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - description: "" + name: CHAINS-GIT_URL + value: $(tasks.clone-repository.results.url) + - description: "" + name: CHAINS-GIT_COMMIT + value: $(tasks.clone-repository.results.commit) + tasks: + - name: init + params: + - name: enable-cache-proxy + value: $(params.enable-cache-proxy) + taskRef: + params: + - name: name + value: init + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.2@sha256:421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db + - name: kind + value: task + resolver: bundles + - name: clone-repository + params: + - name: url + value: $(params.git-url) + - name: revision + value: $(params.revision) + - name: ociStorage + value: $(params.output-image).git + - name: ociArtifactExpiresAfter + value: $(params.image-expires-after) + runAfter: + - init + taskRef: + params: + - name: name + value: git-clone-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.4@sha256:df3c42d78223f07b40a84dd29e5c8860d14777ffdf150ea08c738770f51216dc + - name: kind + value: task + resolver: bundles + workspaces: + - name: basic-auth + workspace: git-auth + - name: prefetch-dependencies + params: + - name: input + value: $(params.prefetch-input) + - name: enable-package-registry-proxy + value: $(params.enable-package-registry-proxy) + - name: SOURCE_ARTIFACT + value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) + - name: ociStorage + value: $(params.output-image).prefetch + - name: ociArtifactExpiresAfter + value: $(params.image-expires-after) + runAfter: + - clone-repository + taskRef: + params: + - name: name + value: prefetch-dependencies-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3.2@sha256:389aea03a065e8118d36b7acb85b05cd13f6750e7e10ff8a85f270ee65b0167b + - name: kind + value: task + resolver: bundles + workspaces: + - name: git-basic-auth + workspace: git-auth + - name: netrc + workspace: netrc + - matrix: + params: + - name: PLATFORM + value: + - $(params.build-platforms) + name: build-images + params: + - name: IMAGE + value: $(params.output-image) + - name: DOCKERFILE + value: $(params.dockerfile) + - name: CONTEXT + value: $(params.path-context) + - name: HERMETIC + value: $(params.hermetic) + - name: PREFETCH_INPUT + value: $(params.prefetch-input) + - name: IMAGE_EXPIRES_AFTER + value: $(params.image-expires-after) + - name: COMMIT_SHA + value: $(tasks.clone-repository.results.commit) + - name: BUILD_ARGS + value: + - $(params.build-args[*]) + - name: BUILD_ARGS_FILE + value: $(params.build-args-file) + - name: PRIVILEGED_NESTED + value: $(params.privileged-nested) + - name: SOURCE_URL + value: $(tasks.clone-repository.results.url) + - name: BUILDAH_FORMAT + value: $(params.buildah-format) + - name: HTTP_PROXY + value: $(tasks.init.results.http-proxy) + - name: NO_PROXY + value: $(tasks.init.results.no-proxy) + - name: SOURCE_DATE_EPOCH + value: $(params.source-date-epoch) + - name: REWRITE_TIMESTAMP + value: $(params.rewrite-timestamp) + - name: OMIT_HISTORY + value: $(params.omit-history) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + - name: IMAGE_APPEND_PLATFORM + value: "true" + runAfter: + - prefetch-dependencies + taskRef: + params: + - name: name + value: buildah-remote-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.10.5@sha256:eb277ec7b44443f0506a60ac940a2e52178d60f17cb0f51a6966daed5b3755de + - name: kind + value: task + resolver: bundles + - name: build-image-index + params: + - name: IMAGE + value: $(params.output-image) + - name: ALWAYS_BUILD_INDEX + value: $(params.build-image-index) + - name: IMAGES + value: + - $(tasks.build-images.results.IMAGE_REF[*]) + - name: BUILDAH_FORMAT + value: $(params.buildah-format) + runAfter: + - build-images + taskRef: + params: + - name: name + value: build-image-index + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:cc75f64deecccb1b59e96ac1182665a5342d79c9e22eebff63d26b0f00a4319c + - name: kind + value: task + resolver: bundles + - name: build-source-image + params: + - name: BINARY_IMAGE + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: BINARY_IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: source-build-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:7c5575ac8e292f27f57716c021ab0324460dc958e73946724c588c5228e5f372 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.build-source-image) + operator: in + values: + - "true" + - name: deprecated-base-image-check + params: + - name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: deprecated-image-check + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:0ccc688a77e9b7b0b8973c132a1e840844137e77f887be4a0bec8893b0776872 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - matrix: + params: + - name: image-platform + value: + - $(params.build-platforms) + name: clair-scan + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: clair-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:f5b4415db9ac1fba3e11d993a617e0b275d1f0ed2fc669b12c400ed848c39174 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - matrix: + params: + - name: platform + value: + - $(params.build-platforms) + name: ecosystem-cert-preflight-checks + params: + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: ecosystem-cert-preflight-checks + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:42720a1e9ed1ef75b615a03e521d01e3ce7ca67c995366a374a58e1307986c58 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-snyk-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: TARGET_DIRS + value: $(params.sast-target-dirs) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-snyk-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:eba24f5d9f4b18aa71e523b9b3dbcf22982aa4b018824260a090b19dfc9abf6f + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - matrix: + params: + - name: image-arch + value: + - $(params.build-platforms) + name: clamav-scan + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: clamav-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-shell-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: TARGET_DIRS + value: $(params.sast-target-dirs) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-shell-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:61b27e6ad5daba761d41bb37efb790ed98380603fd4fe2f86d156def5bd72ecc + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-unicode-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: TARGET_DIRS + value: $(params.sast-target-dirs) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-unicode-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:eb9d5392f215cb8b52b16382098cac4885b1e6cd989f88ebd83fdb234d283eb9 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: apply-tags + params: + - name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: apply-tags + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:3ab844157eccd68e95e4852adc06c3c4ea674edb7865a474b0a898227f2893d6 + - name: kind + value: task + resolver: bundles + - name: push-dockerfile + params: + - name: IMAGE + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: DOCKERFILE + value: $(params.dockerfile) + - name: CONTEXT + value: $(params.path-context) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: push-dockerfile-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:5a6cbebd89e5bc163b38231859767f7f6a0dd66cf1333699574379f062731183 + - name: kind + value: task + resolver: bundles + - name: rpms-signature-scan + params: + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: rpms-signature-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cc5133504ff03909ae970db81a986cb25a5532b2faf62a8ede5c60f28b716f54 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + workspaces: + - name: git-auth + optional: true + - name: netrc + optional: true + taskRunTemplate: + serviceAccountName: build-pipeline-functions-utils + workspaces: + - name: git-auth + secret: + secretName: '{{ git_auth_secret }}' +status: {} From 8273966d60438593ce27a58457aa16facb812fcc Mon Sep 17 00:00:00 2001 From: Marek Schmidt Date: Fri, 14 Aug 2026 12:16:04 +0200 Subject: [PATCH 11/38] update cel expressions and arch list --- .tekton/functions-utils-pull-request.yaml | 12 +++++++++++- .tekton/functions-utils-push.yaml | 12 +++++++++++- 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/.tekton/functions-utils-pull-request.yaml b/.tekton/functions-utils-pull-request.yaml index 7665164340..e4801fc96e 100644 --- a/.tekton/functions-utils-pull-request.yaml +++ b/.tekton/functions-utils-pull-request.yaml @@ -9,7 +9,14 @@ metadata: pipelinesascode.tekton.dev/cancel-in-progress: "true" pipelinesascode.tekton.dev/max-keep-runs: "3" pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch - == "main" + == "main" && ("Dockerfile.utils.rhel9".pathChanged() + || "cmd/func-util/***".pathChanged() + || "pkg/***".pathChanged() + || "go.mod".pathChanged() + || "go.sum".pathChanged() + || "LICENSE".pathChanged() + || ".tekton/functions-utils-push.yaml".pathChanged() + || ".tekton/functions-utils-pull-request.yaml".pathChanged()) labels: appstudio.openshift.io/application: serverless-functions appstudio.openshift.io/component: functions-utils @@ -29,6 +36,9 @@ spec: - name: build-platforms value: - linux/x86_64 + - linux/arm64 + - linux/s390x + - linux/ppc64le - name: dockerfile value: ./Dockerfile.utils.rhel9 pipelineSpec: diff --git a/.tekton/functions-utils-push.yaml b/.tekton/functions-utils-push.yaml index a2cd95c02c..c641395918 100644 --- a/.tekton/functions-utils-push.yaml +++ b/.tekton/functions-utils-push.yaml @@ -8,7 +8,14 @@ metadata: pipelinesascode.tekton.dev/cancel-in-progress: "false" pipelinesascode.tekton.dev/max-keep-runs: "3" pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch - == "main" + == "main" && ("Dockerfile.utils.rhel9".pathChanged() + || "cmd/func-util/***".pathChanged() + || "pkg/***".pathChanged() + || "go.mod".pathChanged() + || "go.sum".pathChanged() + || "LICENSE".pathChanged() + || ".tekton/functions-utils-push.yaml".pathChanged() + || ".tekton/functions-utils-pull-request.yaml".pathChanged()) labels: appstudio.openshift.io/application: serverless-functions appstudio.openshift.io/component: functions-utils @@ -26,6 +33,9 @@ spec: - name: build-platforms value: - linux/x86_64 + - linux/arm64 + - linux/s390x + - linux/ppc64le - name: dockerfile value: ./Dockerfile.utils.rhel9 pipelineSpec: From 12c2ae83de2167f6d14b3aa07d4fa678e1533e39 Mon Sep 17 00:00:00 2001 From: "openshift-rebasebot[bot]" <289950310+openshift-rebasebot[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 12:11:45 +0000 Subject: [PATCH 12/38] UPSTREAM: : Remove upstream-only files not used in OpenShift org # Conflicts: # .github/workflows/functions.yaml --- .github/actions/codecov/action.yml | 42 -- .github/pull-request-template.md | 73 --- .github/workflows/functions.yaml | 571 ------------------ .github/workflows/knative-go-build.yaml | 14 - .github/workflows/knative-go-test.yaml | 19 - .github/workflows/knative-security.yaml | 17 - .github/workflows/knative-stale.yaml | 14 - .github/workflows/knative-style.yaml | 15 - .github/workflows/knative-verify.yaml | 26 - .github/workflows/test-podman-next.yaml | 57 -- .github/workflows/update-builder.yaml | 37 -- .github/workflows/update-ca-bundle.yaml | 32 - .github/workflows/update-python-platform.yaml | 54 -- .../workflows/update-quarkus-platform.yaml | 37 -- .../workflows/update-springboot-platform.yaml | 37 -- .ko.yaml | 3 - OWNERS_ALIASES | 121 ---- 17 files changed, 1169 deletions(-) delete mode 100644 .github/actions/codecov/action.yml delete mode 100644 .github/pull-request-template.md delete mode 100644 .github/workflows/functions.yaml delete mode 100644 .github/workflows/knative-go-build.yaml delete mode 100644 .github/workflows/knative-go-test.yaml delete mode 100644 .github/workflows/knative-security.yaml delete mode 100644 .github/workflows/knative-stale.yaml delete mode 100644 .github/workflows/knative-style.yaml delete mode 100644 .github/workflows/knative-verify.yaml delete mode 100644 .github/workflows/test-podman-next.yaml delete mode 100644 .github/workflows/update-builder.yaml delete mode 100644 .github/workflows/update-ca-bundle.yaml delete mode 100644 .github/workflows/update-python-platform.yaml delete mode 100644 .github/workflows/update-quarkus-platform.yaml delete mode 100644 .github/workflows/update-springboot-platform.yaml delete mode 100644 .ko.yaml delete mode 100644 OWNERS_ALIASES diff --git a/.github/actions/codecov/action.yml b/.github/actions/codecov/action.yml deleted file mode 100644 index bcca252b8e..0000000000 --- a/.github/actions/codecov/action.yml +++ /dev/null @@ -1,42 +0,0 @@ -name: codecov -description: > - Upload coverage to Codecov when a token is available. No-ops when the token - is empty so fork PRs (no CODECOV_TOKEN secret) stay green after tests pass. - -# Callers pass secrets.CODECOV_TOKEN as inputs.token — secrets cannot be used -# in step-level if: expressions, so the empty-token check lives here once. - -inputs: - token: - description: Codecov upload token; empty skips the upload - required: false - default: "" - files: - description: Coverage file path(s) for codecov-action - required: false - default: ./coverage.txt - flags: - description: Codecov flags (e.g. unit, integration, e2e) - required: false - default: "" - fail_ci_if_error: - description: Fail the job if Codecov upload errors (only when uploading) - required: false - default: "true" - verbose: - description: Verbose codecov-action logging - required: false - default: "true" - -runs: - using: composite - steps: - - name: Upload coverage to Codecov - if: ${{ inputs.token != '' }} - uses: codecov/codecov-action@v7 - with: - files: ${{ inputs.files }} - flags: ${{ inputs.flags }} - fail_ci_if_error: ${{ inputs.fail_ci_if_error }} - verbose: ${{ inputs.verbose }} - token: ${{ inputs.token }} diff --git a/.github/pull-request-template.md b/.github/pull-request-template.md deleted file mode 100644 index e19139f786..0000000000 --- a/.github/pull-request-template.md +++ /dev/null @@ -1,73 +0,0 @@ - - - - -# Changes - - - -- -- -- - - -/kind - - -Fixes # - - - -**Release Note** - - -```release-note - -``` - -**Docs** - - -```docs - -``` diff --git a/.github/workflows/functions.yaml b/.github/workflows/functions.yaml deleted file mode 100644 index 6d7e7e3988..0000000000 --- a/.github/workflows/functions.yaml +++ /dev/null @@ -1,571 +0,0 @@ -name: Functions - -# To run this workflow's tests locally, see ./hack/test-full.sh -# -# Fork CI note (Hamr#395 external-dev / Functions#57): coverage upload goes through -# ./.github/actions/codecov — no-ops when CODECOV_TOKEN is empty so forks without -# the secret stay green after tests. Upstream knative/func still uploads when set. - - -permissions: - id-token: write # Required for signing - contents: read - packages: write - attestations: write - -on: - push: - branches: - - main - - 'release-*' - paths-ignore: - - 'docs/**/*.md' - - '*.md' - - 'OWNERS' - - 'OWNERS_ALIASES' - - 'LICENSE' - pull_request: - branches: - - main - - 'release-*' - paths-ignore: - - 'docs/**/*.md' - - '*.md' - - 'OWNERS' - - 'OWNERS_ALIASES' - - 'LICENSE' - workflow_dispatch: - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: ${{ github.event_name == 'pull_request' }} - -# Global version definitions -env: - PYTHON_VERSION: "3.10" - NODE_VERSION: "20" - JAVA_VERSION: "21" - JAVA_DISTRIBUTION: "temurin" - -jobs: - # -------- - # PRECHECK - # -------- - precheck: - name: Precheck - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - uses: actions/checkout@v4 - - uses: knative/actions/setup-go@main - - - name: Check and Lint - run: make check - - name: Check Generated Schema File - run: make check-schema - - name: Check Templates - run: make check-templates - - name: Check Embedded FS - run: make check-embedded-fs - - # ---------- - # UNIT TESTS - # ---------- - test-unit: - name: Unit Tests - needs: precheck - strategy: - fail-fast: false - matrix: - os: - - "ubuntu-latest" # x86_64 - - "ubuntu-24.04-arm" # ARM64 - - "macos-latest" # Intel - - "macos-14" # ARM - - "windows-latest" - runs-on: ${{ matrix.os }} - timeout-minutes: 30 - steps: - - name: Disable CRLF conversion (Windows) - if: runner.os == 'Windows' - run: git config --global core.autocrlf false - - - uses: actions/checkout@v4 - - uses: knative/actions/setup-go@main - - - name: Run Unit Tests - run: make test - - - uses: ./.github/actions/codecov - with: - token: ${{ secrets.CODECOV_TOKEN }} - flags: unit ${{ matrix.os }} - - # -------------- - # TEMPLATE TESTS - # -------------- - test-templates: - name: Template Tests - needs: precheck - strategy: - fail-fast: false - matrix: - os: - - "ubuntu-latest" # x86_64 - - "ubuntu-24.04-arm" # ARM64 - - "macos-latest" # Intel - - "macos-14" # ARM - - "windows-latest" - runs-on: ${{ matrix.os }} - timeout-minutes: 60 - steps: - # Setup - - name: Disable CRLF conversion (Windows) - if: runner.os == 'Windows' - run: git config --global core.autocrlf false - - - uses: actions/checkout@v4 - - uses: knative/actions/setup-go@main - - # Toolchains - - name: Setup Python - uses: actions/setup-python@v5 - with: - python-version: ${{ env.PYTHON_VERSION }} - - name: Setup Node.js - uses: actions/setup-node@v4 - with: - node-version: ${{ env.NODE_VERSION }} - - name: Setup Java - uses: actions/setup-java@v4 - with: - java-version: ${{ env.JAVA_VERSION }} - distribution: ${{ env.JAVA_DISTRIBUTION }} - - name: Setup Rust - uses: actions-rust-lang/setup-rust-toolchain@v1 - - # Run - - name: Templates Tests - run: make test-templates - - # ----------------- - # INTEGRATION TESTS - # ----------------- - test-integration: - name: Integration Tests - needs: precheck - runs-on: ubuntu-latest - timeout-minutes: 120 - env: - FUNC_CLUSTER_RETRIES: 5 - FUNC_INT_TEKTON_ENABLED: true - FUNC_INT_GITLAB_ENABLED: true - FUNC_INT_GITLAB_HOSTNAME: gitlab.localtest.me - FUNC_TEST_GITLAB_PASS: test-password-123 - FUNC_INT_PAC_HOST: pac-ctr.localtest.me - KUBECONFIG: ${{github.workspace}}/hack/bin/kubeconfig.yaml - steps: - - uses: actions/checkout@v4 - - uses: knative/actions/setup-go@main - - uses: endersonmenezes/free-disk-space@v3 - with: - remove_android: true - remove_dotnet: true - remove_haskell: true - remove_swap: true - rm_cmd: "rmz" # Faster than rm - - - name: Install Binaries - run: ./hack/binaries.sh - - name: Allocate Cluster - run: ./hack/cluster.sh - - name: Start Local Registry - run: ./hack/registry.sh - - name: Prepare Images - run: ./hack/images.sh - - name: Install Gitlab - run: ./hack/gitlab.sh - - name: Install Git Server - run: ./hack/git-server.sh - - - name: Run Integration Tests - run: make test-integration - - - uses: ./.github/actions/codecov - with: - token: ${{ secrets.CODECOV_TOKEN }} - flags: integration - - # Preserve Cluster Logs - - name: Dump Cluster Logs - if: always() - run: ./hack/dump-logs.sh cluster_log.txt - - name: Archive Cluster Logs - if: always() - uses: actions/upload-artifact@v4 - with: - name: cluster-logs-integration - path: ./cluster_log.txt - retention-days: 7 - - # --------- - # E2E TESTS - # --------- - # Runs Core, Metadata, and Remote - test-e2e: - name: E2E - Core, Metadata, and Remote - needs: precheck - runs-on: ubuntu-latest - timeout-minutes: 120 - env: - FUNC_CLUSTER_RETRIES: 5 - FUNC_E2E_CLEAN: false # cluster only used once - FUNC_E2E_VERBOSE: true - FUNC_CLUSTER_KEDA: "false" # these tests don't use KEDA; skip it to free cluster CPU (PR #3914 'Insufficient cpu') - steps: - - uses: actions/checkout@v4 - - uses: knative/actions/setup-go@main - - uses: endersonmenezes/free-disk-space@v3 - with: - remove_android: true - remove_dotnet: true - remove_haskell: true - remove_swap: true - rm_cmd: "rmz" # Faster than rm - - - name: Install Binaries - run: ./hack/binaries.sh - - name: Allocate Cluster - run: ./hack/cluster.sh - - name: Start Local Registry - run: ./hack/registry.sh - - name: Prepare Images - run: ./hack/images.sh - - - name: Run Basic E2E Tests (core, metadata, remote) - run: make test-e2e - - - uses: ./.github/actions/codecov - with: - token: ${{ secrets.CODECOV_TOKEN }} - flags: e2e - - # Preserve Cluster Logs - - name: Dump Cluster Logs - if: always() - run: ./hack/dump-logs.sh cluster_log.txt - - name: Archive Cluster Logs - if: always() - uses: actions/upload-artifact@v4 - with: - name: cluster-logs-e2e-core - path: ./cluster_log.txt - retention-days: 7 - - # ---------------- - # E2E PODMAN TESTS - # ---------------- - test-e2e-podman: - name: E2E - Podman - needs: precheck - timeout-minutes: 120 - strategy: - matrix: - os: - - "ubuntu-latest" # x86_64 - - "ubuntu-24.04-arm" # ARM64 - runs-on: ${{ matrix.os }} - env: - FUNC_CLUSTER_RETRIES: 5 - FUNC_E2E_PODMAN: true - FUNC_E2E_CLEAN: false # cluster only used once - FUNC_E2E_VERBOSE: true - steps: - - uses: actions/checkout@v4 - - uses: knative/actions/setup-go@main - - - uses: endersonmenezes/free-disk-space@v3 - with: - remove_android: true - remove_dotnet: true - remove_haskell: true - remove_swap: true - rm_cmd: "rmz" # Faster than rm - - - name: Start Podman - run: sudo apt update && sudo apt install -y podman && podman system service --time=0 & - - - name: Install Binaries - run: ./hack/binaries.sh - - name: Allocate Cluster - run: ./hack/cluster.sh - - name: Start Local Registry - run: ./hack/registry.sh - - - name: Run E2E Podman Tests - run: make test-e2e-podman - - - uses: ./.github/actions/codecov - with: - token: ${{ secrets.CODECOV_TOKEN }} - flags: e2e - - # Preserve Cluster Logs - - name: Dump Cluster Logs - if: always() - run: ./hack/dump-logs.sh cluster_log.txt - - name: Archive Cluster Logs - if: always() - uses: actions/upload-artifact@v4 - with: - name: cluster-logs-${{ matrix.os }}-podman - path: ./cluster_log.txt - retention-days: 7 - - # ----------------- - # E2E RUNTIME TESTS - # ----------------- - test-e2e-runtimes: - name: E2E - Runtimes - needs: precheck - strategy: - matrix: - runtime: - - "go" - - "python" - - "node" - - "typescript" - - "rust" - - "quarkus" - - "springboot" - runs-on: ubuntu-latest - timeout-minutes: 90 - env: - FUNC_CLUSTER_RETRIES: 5 # Cluster allocation retries - FUNC_E2E_CLEAN: false # Skip deletes (cluster not reused) - FUNC_E2E_MATRIX: true # Enables the language runtime matrix tests - FUNC_E2E_VERBOSE: true - FUNC_E2E_MATRIX_RUNTIMES: ${{ matrix.runtime }} - steps: - - uses: actions/checkout@v4 - - uses: knative/actions/setup-go@main - - uses: endersonmenezes/free-disk-space@v3 - with: - remove_android: true - remove_dotnet: true - remove_haskell: true - remove_swap: true - rm_cmd: "rmz" # Faster than rm - - # Install Toolchain Being Tested - - name: Setup Python - if: matrix.runtime == 'python' - uses: actions/setup-python@v5 - with: - python-version: ${{ env.PYTHON_VERSION }} - - name: Setup Node.js - if: matrix.runtime == 'node' || matrix.runtime == 'typescript' - uses: actions/setup-node@v4 - with: - node-version: ${{ env.NODE_VERSION }} - - name: Setup Java - if: matrix.runtime == 'quarkus' || matrix.runtime == 'springboot' - uses: actions/setup-java@v4 - with: - java-version: ${{ env.JAVA_VERSION }} - distribution: ${{ env.JAVA_DISTRIBUTION }} - - name: Setup Rust - if: matrix.runtime == 'rust' - uses: actions-rust-lang/setup-rust-toolchain@v1 - - # Allocate Cluster - - name: Install Binaries - run: ./hack/binaries.sh - - name: Allocate Cluster - run: ./hack/cluster.sh - - name: Start Local Registry - run: ./hack/registry.sh - - name: Prepare Images - run: ./hack/images.sh - - - name: Run Test - ${{ matrix.runtime }} - run: make test-e2e-matrix - - # Coverage and Logs - - uses: ./.github/actions/codecov - with: - token: ${{ secrets.CODECOV_TOKEN }} - flags: e2e ${{ matrix.runtime }} - - # Preserve Cluster Logs - - name: Dump Cluster Logs - if: always() - run: ./hack/dump-logs.sh cluster_log.txt - - name: Archive Cluster Logs - if: always() - uses: actions/upload-artifact@v4 - with: - name: cluster-logs-${{ matrix.runtime }} - path: ./cluster_log.txt - retention-days: 7 - - # ------------------- - # E2E CONFIG CI TESTS - # ------------------- - test-e2e-config-ci: - name: E2E - Config CI GitHub Workflows - needs: precheck - runs-on: ubuntu-latest - timeout-minutes: 120 - env: - FUNC_CLUSTER_RETRIES: 5 - FUNC_E2E_CLEAN: false - FUNC_E2E_VERBOSE: true - steps: - - uses: actions/checkout@v4 - - uses: knative/actions/setup-go@main - - uses: endersonmenezes/free-disk-space@v3 - with: - remove_android: true - remove_dotnet: true - remove_haskell: true - remove_swap: true - rm_cmd: "rmz" - - - name: Install Binaries - run: ./hack/binaries.sh - - name: Allocate Cluster - run: ./hack/cluster.sh - - name: Start Local Registry - run: ./hack/registry.sh - - name: Prepare Images - run: ./hack/images.sh - - - name: Run Config CI E2E Tests - run: make test-e2e-config-ci - - - uses: ./.github/actions/codecov - with: - token: ${{ secrets.CODECOV_TOKEN }} - flags: e2e-config-ci - - # Preserve Cluster Logs - - name: Dump Cluster Logs - if: always() - run: ./hack/dump-logs.sh cluster_log.txt - - name: Archive Cluster Logs - if: always() - uses: actions/upload-artifact@v4 - with: - name: cluster-logs-e2e-config-ci - path: ./cluster_log.txt - retention-days: 7 - - # Build and Publish - build: - name: Build Release - needs: - - test-unit - - test-integration - - test-templates - - test-e2e - - test-e2e-podman - - test-e2e-runtimes - - test-e2e-config-ci - if: github.event_name == 'push' && github.ref == 'refs/heads/main' - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - uses: actions/checkout@v4 - - uses: knative/actions/setup-go@main - - name: Build Platform Binaries - run: make cross-platform - - uses: actions/upload-artifact@v4 - with: - name: OSX Binary (AMD) - path: func_darwin_amd64 - retention-days: 30 - - uses: actions/upload-artifact@v4 - with: - name: OSX Binary (ARM) - path: func_darwin_arm64 - retention-days: 30 - - uses: actions/upload-artifact@v4 - with: - name: Linux Binary (AMD) - path: func_linux_amd64 - retention-days: 30 - - uses: actions/upload-artifact@v4 - with: - name: Linux Binary (ARM) - path: func_linux_arm64 - retention-days: 30 - - uses: actions/upload-artifact@v4 - with: - name: Linux Binary (PPC64LE) - path: func_linux_ppc64le - retention-days: 30 - - uses: actions/upload-artifact@v4 - with: - name: Linux Binary (S390X) - path: func_linux_s390x - retention-days: 30 - - uses: actions/upload-artifact@v4 - with: - name: Windows Binary - path: func_windows_amd64.exe - retention-days: 30 - - publish-utils-image: - name: Publish Utils Image - needs: build - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - uses: actions/checkout@v4 - - uses: knative/actions/setup-go@main - - uses: docker/setup-qemu-action@v3 - - name: Login to GitHub Container Registry - uses: docker/login-action@v3 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - name: Build and push - id: build-images - run: | - for a in amd64 arm64 ppc64le s390x; do - CGO_ENABLED=0 GOARCH="${a}" go build -buildvcs=false -o "func-util-$a" -trimpath -ldflags '-w -s' ./cmd/func-util - done - export SOURCE_DATE_EPOCH=0 - docker buildx create --name multiarch --driver docker-container --use - docker buildx build . -f Dockerfile.utils \ - --output type=image,rewrite-timestamp=true \ - --provenance=false --sbom=false \ - --platform=linux/ppc64le,linux/s390x,linux/amd64,linux/arm64 \ - --push \ - -t "ghcr.io/knative/func-utils:v2" \ - --annotation index:org.opencontainers.image.description="Knative Func Utils Image" \ - --annotation index:org.opencontainers.image.source="https://github.com/knative/func" \ - --annotation index:org.opencontainers.image.vendor="https://github.com/knative/func" \ - --annotation index:org.opencontainers.image.url="https://github.com/knative/func/pkgs/container/func-utils" \ - --metadata-file build-metadata.json - DIGEST="$(jq -r '."containerimage.digest"' build-metadata.json)" - echo "digest=${DIGEST}" >> "${GITHUB_OUTPUT}" - - name: Attest Build Provenance - uses: actions/attest-build-provenance@v3 - with: - subject-name: "ghcr.io/knative/func-utils" - subject-digest: ${{ steps.build-images.outputs.digest }} - push-to-registry: true - - publish-image: - name: Publish as Image - needs: build - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - uses: actions/checkout@v4 - - uses: knative/actions/setup-go@main - - uses: imjasonh/setup-ko@v0.6 - - run: ko build --platform=linux/ppc64le,linux/s390x,linux/amd64,linux/arm64 -B ./cmd/func diff --git a/.github/workflows/knative-go-build.yaml b/.github/workflows/knative-go-build.yaml deleted file mode 100644 index 10c3de1a1e..0000000000 --- a/.github/workflows/knative-go-build.yaml +++ /dev/null @@ -1,14 +0,0 @@ -# Copyright 2020 The Knative Authors. -# SPDX-License-Identifier: Apache-2.0 - -# This file is automagically synced here from github.com/knative-extensions/knobots - -name: Build - -on: - pull_request: - branches: [ 'main', 'release-*' ] - -jobs: - build: - uses: knative/actions/.github/workflows/reusable-go-build.yaml@main diff --git a/.github/workflows/knative-go-test.yaml b/.github/workflows/knative-go-test.yaml deleted file mode 100644 index aa3ec66c5d..0000000000 --- a/.github/workflows/knative-go-test.yaml +++ /dev/null @@ -1,19 +0,0 @@ -# Copyright 2022 The Knative Authors. -# SPDX-License-Identifier: Apache-2.0 - -# This file is automagically synced here from github.com/knative-extensions/knobots - -name: Test - -on: - push: - branches: [ 'main', 'release-*' ] - - pull_request: - branches: [ 'main', 'release-*' ] - -jobs: - test: - uses: knative/actions/.github/workflows/reusable-go-test.yaml@main - secrets: - CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/knative-security.yaml b/.github/workflows/knative-security.yaml deleted file mode 100644 index a6cd68137a..0000000000 --- a/.github/workflows/knative-security.yaml +++ /dev/null @@ -1,17 +0,0 @@ -# Copyright 2020 The Knative Authors. -# SPDX-License-Identifier: Apache-2.0 - -# This file is automagically synced here from github.com/knative-extensions/knobots - -name: 'Security' - -on: - push: - branches: [ 'main', 'release-*' ] - - pull_request: - branches: [ 'main', 'release-*' ] - -jobs: - analyze: - uses: knative/actions/.github/workflows/reusable-security.yaml@main diff --git a/.github/workflows/knative-stale.yaml b/.github/workflows/knative-stale.yaml deleted file mode 100644 index 2e25b9d99a..0000000000 --- a/.github/workflows/knative-stale.yaml +++ /dev/null @@ -1,14 +0,0 @@ -# Copyright 2020 The Knative Authors. -# SPDX-License-Identifier: Apache-2.0 - -# This file is automagically synced here from github.com/knative-extensions/knobots -name: 'Close stale' - -on: - schedule: - - cron: '0 1 * * *' - -jobs: - - stale: - uses: knative/actions/.github/workflows/reusable-stale.yaml@main diff --git a/.github/workflows/knative-style.yaml b/.github/workflows/knative-style.yaml deleted file mode 100644 index 55bb1537cc..0000000000 --- a/.github/workflows/knative-style.yaml +++ /dev/null @@ -1,15 +0,0 @@ -# Copyright 2020 The Knative Authors. -# SPDX-License-Identifier: Apache-2.0 - -# This file is automagically synced here from github.com/knative-extensions/knobots - -name: Code Style - -on: - pull_request: - branches: [ 'main', 'release-*' ] - -jobs: - - style: - uses: knative/actions/.github/workflows/reusable-style.yaml@main diff --git a/.github/workflows/knative-verify.yaml b/.github/workflows/knative-verify.yaml deleted file mode 100644 index e1a28c4f50..0000000000 --- a/.github/workflows/knative-verify.yaml +++ /dev/null @@ -1,26 +0,0 @@ -# Copyright 2020 The Knative Authors. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# This file is automagically synced here from github.com/knative-extensions/.github -# repo by knobots: https://github.com/knative-extensions/knobots and will be overwritten. - -name: Verify - -on: - pull_request: - branches: [ 'main', 'release-*' ] - -jobs: - verify: - uses: knative/actions/.github/workflows/reusable-verify-codegen.yaml@main diff --git a/.github/workflows/test-podman-next.yaml b/.github/workflows/test-podman-next.yaml deleted file mode 100644 index 38a77aeb2d..0000000000 --- a/.github/workflows/test-podman-next.yaml +++ /dev/null @@ -1,57 +0,0 @@ -name: Func Podman Next Test - -permissions: - contents: read - -on: - schedule: - - cron: '0 2 * * *' - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - test: - name: Podman Next Test - runs-on: ubuntu-latest - timeout-minutes: 60 - steps: - - uses: endersonmenezes/free-disk-space@v3 - with: - remove_android: true - remove_dotnet: true - remove_haskell: true - remove_swap: true - rm_cmd: "rmz" # Faster than rm - - name: Set Environment Variables - run: | - echo "KUBECONFIG=${{ github.workspace }}/hack/bin/kubeconfig.yaml" >> "$GITHUB_ENV" - echo "PATH=${{ github.workspace }}/hack/bin:$PATH" >> "$GITHUB_ENV" - echo "FUNC_ALLOCATE_RETRIES=5" >> "$GITHUB_ENV" - - name: Disable CLRF conversion - run: git config --global core.autocrlf false - - uses: actions/checkout@v4 - - uses: knative/actions/setup-go@main - - name: Install Binaries - run: ./hack/binaries.sh - - name: Allocate Cluster - run: ./hack/cluster.sh - - name: Local Registry - run: ./hack/registry.sh - - name: Setup testing images - run: ./hack/images.sh - - name: Integration Test Podman - run: | - docker build . -f Dockerfile.podman-next -t podman-next - docker run -i --rm --network=host --name podman-next-test --privileged -v /var/tmp -v /var/lib/containers podman-next ./hack/test-integration-podman.sh - - name: Dump Cluster Logs - if: always() - run: ./hack/dump-logs.sh cluster_log.txt - - name: Archive Cluster Logs - if: always() - uses: actions/upload-artifact@v4 - with: - name: cluster-logs-podman-next - path: ./cluster_log.txt - retention-days: 7 diff --git a/.github/workflows/update-builder.yaml b/.github/workflows/update-builder.yaml deleted file mode 100644 index beb4427d88..0000000000 --- a/.github/workflows/update-builder.yaml +++ /dev/null @@ -1,37 +0,0 @@ -name: Update builder-jammy-full image - -on: - schedule: - - cron: '0 */4 * * *' - workflow_dispatch: - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - build-and-push-image: - permissions: - contents: read - packages: write - runs-on: "ubuntu-latest" - timeout-minutes: 30 - steps: - - uses: actions/checkout@v4 - - uses: knative/actions/setup-go@main - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - name: Build and Push - env: - GITHUB_TOKEN: ${{ github.token }} - run: | - docker run -d -p 5000:5000 --name registry registry:2.7 - echo '{"insecure-registries" : "localhost:5000" }' | \ - sudo tee /etc/docker/daemon.json - mkdir -p "$HOME/.config/containers/" - echo -e '\n[[registry]]\nlocation = "localhost:5000"\ninsecure = true\n' >> \ - "$HOME/.config/containers/registries.conf" - skopeo login ghcr.io -u gh-action -p "$GITHUB_TOKEN" - docker login ghcr.io -u gh-action -p "$GITHUB_TOKEN" - make __update-builder - diff --git a/.github/workflows/update-ca-bundle.yaml b/.github/workflows/update-ca-bundle.yaml deleted file mode 100644 index 56bb9bcbdf..0000000000 --- a/.github/workflows/update-ca-bundle.yaml +++ /dev/null @@ -1,32 +0,0 @@ -name: Update CA bundle in embedded templates - -permissions: - contents: write - pull-requests: write - -on: - schedule: - - cron: '0 */4 * * *' - workflow_dispatch: - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - update: - name: Update CA bundle - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - uses: actions/checkout@v4 - - uses: actions/setup-node@v4 - with: - node-version: "20" - - name: Install NPM deps. - run: npm install octokit@3.2.1 - - name: Create PR - env: - GITHUB_TOKEN: ${{ github.token }} - run: node ./hack/update-ca-bundle.js - diff --git a/.github/workflows/update-python-platform.yaml b/.github/workflows/update-python-platform.yaml deleted file mode 100644 index 4a4a0da22c..0000000000 --- a/.github/workflows/update-python-platform.yaml +++ /dev/null @@ -1,54 +0,0 @@ -name: Update func-python version in embedded templates - -permissions: - contents: write - pull-requests: write - -on: - schedule: - - cron: "0 6 * * *" # Daily at 06:00. - workflow_dispatch: # Manual workflow trigger - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - update: - name: Update func-python version - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - uses: actions/checkout@v4 - - - uses: knative/actions/setup-go@main - - - name: Run update script - run: go run ./hack/cmd/update-python-platform/main.go - - - name: Run make generate - run: make generate/zz_filesystem_generated.go - - - uses: actions/setup-python@v5 - with: - python-version: "3.10" - - - name: Run smoke tests - run: make test-python - - - name: Create Pull Request - uses: peter-evans/create-pull-request@v7 - with: - token: ${{ github.token }} - commit-message: 'chore: update func-python version' - title: 'chore: update func-python version' - body: | - This PR updates the func-python version in the Python scaffolding templates to the latest version available on PyPI. - - This PR was automatically generated by the [update-python-platform workflow](https://github.com/${{ github.repository }}/actions/workflows/update-python-platform.yaml). - branch: update-func-python - delete-branch: true - committer: Knative Automation - author: Knative Automation - assignees: gauron99, matejvasek, lkingland - base: main diff --git a/.github/workflows/update-quarkus-platform.yaml b/.github/workflows/update-quarkus-platform.yaml deleted file mode 100644 index 11e4284fa0..0000000000 --- a/.github/workflows/update-quarkus-platform.yaml +++ /dev/null @@ -1,37 +0,0 @@ -name: Update Quarkus Platform in embedded templates - -permissions: - contents: write - pull-requests: write - -on: - schedule: - - cron: '0 */4 * * *' - workflow_dispatch: - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - update: - name: Update Quarkus Platform - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - uses: actions/checkout@v4 - - uses: knative/actions/setup-go@main - - uses: actions/setup-node@v4 - with: - node-version: "20" - - uses: actions/setup-java@v4 - with: - java-version: 21 - distribution: 'temurin' - - name: Install NPM deps. - run: npm install xml2js@0.6.2 octokit@3.2.1 - - name: Create PR - env: - GITHUB_TOKEN: ${{ github.token }} - run: node ./hack/update-quarkus-platform.js - diff --git a/.github/workflows/update-springboot-platform.yaml b/.github/workflows/update-springboot-platform.yaml deleted file mode 100644 index feb0b50c5d..0000000000 --- a/.github/workflows/update-springboot-platform.yaml +++ /dev/null @@ -1,37 +0,0 @@ -name: Update Spring Boot Platform in embedded templates - -permissions: - contents: write - pull-requests: write - -on: - schedule: - - cron: '0 */4 * * *' - workflow_dispatch: - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - update: - name: Update Spring Boot Platform - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - uses: actions/checkout@v4 - - uses: knative/actions/setup-go@main - - uses: actions/setup-node@v4 - with: - node-version: "20" - - uses: actions/setup-java@v4 - with: - java-version: 21 - distribution: 'temurin' - - name: Install NPM deps. - run: npm install xml2js@0.6.2 octokit@3.2.1 yaml@2.4.5 semver@7.6.3 - - name: Create PR - env: - GITHUB_TOKEN: ${{ github.token }} - run: node ./hack/update-springboot-platform.js - diff --git a/.ko.yaml b/.ko.yaml deleted file mode 100644 index 9cb7eb95df..0000000000 --- a/.ko.yaml +++ /dev/null @@ -1,3 +0,0 @@ -defaultBaseImage: gcr.io/distroless/static:nonroot -baseImageOverrides: - knative.dev/func/cmd/func: docker.io/library/alpine:latest diff --git a/OWNERS_ALIASES b/OWNERS_ALIASES deleted file mode 100644 index 8e5e64faba..0000000000 --- a/OWNERS_ALIASES +++ /dev/null @@ -1,121 +0,0 @@ -# This file is auto-generated from peribolos. -# Do not modify this file, instead modify peribolos/knative.yaml - -aliases: - client-reviewers: [] - client-wg-leads: - - dsimansk - client-writers: - - dsimansk - docs-reviewers: - - nainaz - - skonto - docs-writers: - - skonto - eventing-reviewers: - - Leo6Leo - - cali0707 - - creydr - eventing-wg-leads: - - creydr - - pierDipi - eventing-writers: - - Leo6Leo - - aliok - - cali0707 - - creydr - - matzew - - pierDipi - func-reviewers: - - jrangelramos - func-writers: - - gauron99 - - jrangelramos - - lkingland - - matejvasek - - matzew - functions-wg-leads: - - lkingland - knative-admin: - - aliok - - arsenetar - - cardil - - dprotaso - - dsimansk - - evankanderson - - knative-automation - - knative-prow-releaser-robot - - knative-prow-robot - - knative-prow-updater-robot - - knative-test-reporter-robot - - matzew - - upodroid - knative-release-leads: - - dprotaso - - dsimansk - knative-robots: - - knative-automation - - knative-prow-releaser-robot - - knative-prow-robot - - knative-prow-updater-robot - - knative-test-reporter-robot - operations-reviewers: - - aliok - - houshengbo - - kahirokunn - - matzew - operations-wg-leads: - - houshengbo - operations-writers: - - aliok - - houshengbo - - matzew - productivity-leads: - - cardil - - upodroid - productivity-reviewers: - - evankanderson - productivity-wg-leads: - - cardil - - upodroid - productivity-writers: - - cardil - - upodroid - security-wg-leads: - - davidhadas - - evankanderson - security-writers: - - davidhadas - - evankanderson - serving-approvers: - - dsimansk - - skonto - serving-reviewers: - - skonto - serving-triage: - - skonto - serving-wg-leads: - - dprotaso - serving-writers: - - dprotaso - - dsimansk - - skonto - steering-committee: - - aliok - - arsenetar - - dprotaso - - evankanderson - - matzew - ux-approvers: - - prajjwalyd - ux-wg-leads: - - Leo6Leo - - cali0707 - - mmejia02 - - zainabhusain227 - ux-writers: - - Leo6Leo - - cali0707 - - mmejia02 - - prajjwalyd - - zainabhusain227 From aedb6bbf444f03eef86ad7444bea88c583c089da Mon Sep 17 00:00:00 2001 From: Marek Schmidt Date: Fri, 14 Aug 2026 14:04:10 +0200 Subject: [PATCH 13/38] initial version of Dockerfile.func.rhel9 --- Dockerfile.func.rhel9 | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 Dockerfile.func.rhel9 diff --git a/Dockerfile.func.rhel9 b/Dockerfile.func.rhel9 new file mode 100644 index 0000000000..f76f7628a8 --- /dev/null +++ b/Dockerfile.func.rhel9 @@ -0,0 +1,33 @@ +ARG GO_BUILDER=registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.26-openshift-5.0 +ARG GO_RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal + +# Reference to the func-util image, baked into the func binary at build time +# so it knows which image to use for in-cluster helper tasks (socat, tar, +# deploy/scaffold/s2i pipeline steps). +ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:90bf0617eeb55c718f1ff9fb2af930330b3d609e8f07e9091965e351923f1329 + +FROM $GO_BUILDER as builder + +ARG FUNC_UTILS_IMG + +WORKDIR /workspace +COPY . . + +ENV CGO_ENABLED=1 +ENV GOEXPERIMENT=strictfipsruntime +ENV GOFLAGS='' + +RUN go build -tags strictfipsruntime,exclude_graphdriver_btrfs \ + -ldflags "-X knative.dev/func/pkg/k8s.SocatImage=$FUNC_UTILS_IMG \ + -X knative.dev/func/pkg/k8s.TarImage=$FUNC_UTILS_IMG \ + -X knative.dev/func/pkg/pipelines/tekton.FuncUtilImage=$FUNC_UTILS_IMG" \ + -o /usr/bin/func ./cmd/func + +FROM $GO_RUNTIME + +COPY --from=builder /usr/bin/func /usr/bin/func +COPY LICENSE /licenses/ + +USER 65532 + +ENTRYPOINT ["/usr/bin/func"] From 8dee40ecf23c4e8418196fcb03c6e9bbc45adfc5 Mon Sep 17 00:00:00 2001 From: "red-hat-konflux-kflux-prd-rh02[bot]" <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> Date: Fri, 14 Aug 2026 12:47:07 +0000 Subject: [PATCH 14/38] Red Hat Konflux kflux-prd-rh02 update functions-func Signed-off-by: red-hat-konflux-kflux-prd-rh02[bot] <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> --- .tekton/functions-func-pull-request.yaml | 581 +++++++++++++++++++++++ .tekton/functions-func-push.yaml | 578 ++++++++++++++++++++++ 2 files changed, 1159 insertions(+) create mode 100644 .tekton/functions-func-pull-request.yaml create mode 100644 .tekton/functions-func-push.yaml diff --git a/.tekton/functions-func-pull-request.yaml b/.tekton/functions-func-pull-request.yaml new file mode 100644 index 0000000000..45867c3051 --- /dev/null +++ b/.tekton/functions-func-pull-request.yaml @@ -0,0 +1,581 @@ +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + annotations: + build.appstudio.openshift.io/repo: https://github.com/openshift/functions?rev={{revision}} + build.appstudio.redhat.com/commit_sha: '{{revision}}' + build.appstudio.redhat.com/pull_request_number: '{{pull_request_number}}' + build.appstudio.redhat.com/target_branch: '{{target_branch}}' + pipelinesascode.tekton.dev/cancel-in-progress: "true" + pipelinesascode.tekton.dev/max-keep-runs: "3" + pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch + == "main" + labels: + appstudio.openshift.io/application: serverless-functions + appstudio.openshift.io/component: functions-func + pipelines.appstudio.openshift.io/type: build + name: functions-func-on-pull-request + namespace: ocp-serverless-tenant +spec: + params: + - name: git-url + value: '{{source_url}}' + - name: revision + value: '{{revision}}' + - name: output-image + value: quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-func:on-pr-{{revision}} + - name: image-expires-after + value: 5d + - name: build-platforms + value: + - linux/x86_64 + - name: dockerfile + value: Dockerfile.func.rhel9 + pipelineSpec: + description: | + This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. + + _Uses `buildah` to create a multi-platform container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. This pipeline requires that the [multi platform controller](https://github.com/konflux-ci/multi-platform-controller) is deployed and configured on your Konflux instance. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://conforma.dev/docs/policy/packages/release_trusted_task.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks. + This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-multi-platform-oci-ta?tab=tags)_ + params: + - description: Source Repository URL + name: git-url + type: string + - default: "" + description: Revision of the Source Repository + name: revision + type: string + - description: Fully Qualified Output Image + name: output-image + type: string + - default: . + description: Path to the source code of an application's component from where + to build image. + name: path-context + type: string + - default: Dockerfile + description: Path to the Dockerfile inside the context specified by parameter + path-context + name: dockerfile + type: string + - default: "false" + description: Skip checks against built image + name: skip-checks + type: string + - default: "false" + description: Execute the build with network isolation + name: hermetic + type: string + - default: "" + description: Build dependencies to be prefetched + name: prefetch-input + type: string + - default: "" + description: Image tag expiration time, time values could be something like + 1h, 2d, 3w for hours, days, and weeks, respectively. + name: image-expires-after + type: string + - default: "false" + description: Build a source image. + name: build-source-image + type: string + - default: "true" + description: Add built image into an OCI image index + name: build-image-index + type: string + - default: docker + description: The format for the resulting image's mediaType. Valid values are + oci or docker. + name: buildah-format + type: string + - default: "false" + description: Enable cache proxy configuration + name: enable-cache-proxy + - default: "true" + description: Use the package registry proxy when prefetching dependencies + name: enable-package-registry-proxy + - default: . + description: Target directories in component's source code to scan with SAST + tools. Multiple values should be separated with commas. + name: sast-target-dirs + type: string + - default: [] + description: Array of --build-arg values ("arg=value" strings) for buildah + name: build-args + type: array + - default: "" + description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file + name: build-args-file + type: string + - default: "false" + description: Whether to enable privileged mode, should be used only with remote + VMs + name: privileged-nested + type: string + - default: "" + description: Sets the image created time and the SOURCE_DATE_EPOCH build argument. + On its own, it does not change file timestamps inside the layers (set rewrite-timestamp + to "true" for that). Leave empty to keep the actual build time. + name: source-date-epoch + type: string + - default: "false" + description: When "true", clamp file modification times in the image layers + to at most source-date-epoch. Does nothing unless source-date-epoch is set. + name: rewrite-timestamp + type: string + - default: "false" + description: When "true", omit the build history (history timestamps, layer + metadata, etc.) from the resulting image. + name: omit-history + type: string + - default: + - linux/x86_64 + description: List of platforms to build the container images on. The available + set of values is determined by the configuration of the multi-platform-controller. + name: build-platforms + type: array + results: + - description: "" + name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - description: "" + name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - description: "" + name: CHAINS-GIT_URL + value: $(tasks.clone-repository.results.url) + - description: "" + name: CHAINS-GIT_COMMIT + value: $(tasks.clone-repository.results.commit) + tasks: + - name: init + params: + - name: enable-cache-proxy + value: $(params.enable-cache-proxy) + taskRef: + params: + - name: name + value: init + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.2@sha256:421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db + - name: kind + value: task + resolver: bundles + - name: clone-repository + params: + - name: url + value: $(params.git-url) + - name: revision + value: $(params.revision) + - name: ociStorage + value: $(params.output-image).git + - name: ociArtifactExpiresAfter + value: $(params.image-expires-after) + runAfter: + - init + taskRef: + params: + - name: name + value: git-clone-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.4@sha256:df3c42d78223f07b40a84dd29e5c8860d14777ffdf150ea08c738770f51216dc + - name: kind + value: task + resolver: bundles + workspaces: + - name: basic-auth + workspace: git-auth + - name: prefetch-dependencies + params: + - name: input + value: $(params.prefetch-input) + - name: enable-package-registry-proxy + value: $(params.enable-package-registry-proxy) + - name: SOURCE_ARTIFACT + value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) + - name: ociStorage + value: $(params.output-image).prefetch + - name: ociArtifactExpiresAfter + value: $(params.image-expires-after) + runAfter: + - clone-repository + taskRef: + params: + - name: name + value: prefetch-dependencies-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3.2@sha256:389aea03a065e8118d36b7acb85b05cd13f6750e7e10ff8a85f270ee65b0167b + - name: kind + value: task + resolver: bundles + workspaces: + - name: git-basic-auth + workspace: git-auth + - name: netrc + workspace: netrc + - matrix: + params: + - name: PLATFORM + value: + - $(params.build-platforms) + name: build-images + params: + - name: IMAGE + value: $(params.output-image) + - name: DOCKERFILE + value: $(params.dockerfile) + - name: CONTEXT + value: $(params.path-context) + - name: HERMETIC + value: $(params.hermetic) + - name: PREFETCH_INPUT + value: $(params.prefetch-input) + - name: IMAGE_EXPIRES_AFTER + value: $(params.image-expires-after) + - name: COMMIT_SHA + value: $(tasks.clone-repository.results.commit) + - name: BUILD_ARGS + value: + - $(params.build-args[*]) + - name: BUILD_ARGS_FILE + value: $(params.build-args-file) + - name: PRIVILEGED_NESTED + value: $(params.privileged-nested) + - name: SOURCE_URL + value: $(tasks.clone-repository.results.url) + - name: BUILDAH_FORMAT + value: $(params.buildah-format) + - name: HTTP_PROXY + value: $(tasks.init.results.http-proxy) + - name: NO_PROXY + value: $(tasks.init.results.no-proxy) + - name: SOURCE_DATE_EPOCH + value: $(params.source-date-epoch) + - name: REWRITE_TIMESTAMP + value: $(params.rewrite-timestamp) + - name: OMIT_HISTORY + value: $(params.omit-history) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + - name: IMAGE_APPEND_PLATFORM + value: "true" + runAfter: + - prefetch-dependencies + taskRef: + params: + - name: name + value: buildah-remote-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.10.5@sha256:eb277ec7b44443f0506a60ac940a2e52178d60f17cb0f51a6966daed5b3755de + - name: kind + value: task + resolver: bundles + - name: build-image-index + params: + - name: IMAGE + value: $(params.output-image) + - name: ALWAYS_BUILD_INDEX + value: $(params.build-image-index) + - name: IMAGES + value: + - $(tasks.build-images.results.IMAGE_REF[*]) + - name: BUILDAH_FORMAT + value: $(params.buildah-format) + runAfter: + - build-images + taskRef: + params: + - name: name + value: build-image-index + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:cc75f64deecccb1b59e96ac1182665a5342d79c9e22eebff63d26b0f00a4319c + - name: kind + value: task + resolver: bundles + - name: build-source-image + params: + - name: BINARY_IMAGE + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: BINARY_IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: source-build-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:7c5575ac8e292f27f57716c021ab0324460dc958e73946724c588c5228e5f372 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.build-source-image) + operator: in + values: + - "true" + - name: deprecated-base-image-check + params: + - name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: deprecated-image-check + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:0ccc688a77e9b7b0b8973c132a1e840844137e77f887be4a0bec8893b0776872 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - matrix: + params: + - name: image-platform + value: + - $(params.build-platforms) + name: clair-scan + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: clair-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:f5b4415db9ac1fba3e11d993a617e0b275d1f0ed2fc669b12c400ed848c39174 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - matrix: + params: + - name: platform + value: + - $(params.build-platforms) + name: ecosystem-cert-preflight-checks + params: + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: ecosystem-cert-preflight-checks + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:42720a1e9ed1ef75b615a03e521d01e3ce7ca67c995366a374a58e1307986c58 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-snyk-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: TARGET_DIRS + value: $(params.sast-target-dirs) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-snyk-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:eba24f5d9f4b18aa71e523b9b3dbcf22982aa4b018824260a090b19dfc9abf6f + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - matrix: + params: + - name: image-arch + value: + - $(params.build-platforms) + name: clamav-scan + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: clamav-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-shell-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: TARGET_DIRS + value: $(params.sast-target-dirs) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-shell-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:61b27e6ad5daba761d41bb37efb790ed98380603fd4fe2f86d156def5bd72ecc + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-unicode-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: TARGET_DIRS + value: $(params.sast-target-dirs) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-unicode-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:eb9d5392f215cb8b52b16382098cac4885b1e6cd989f88ebd83fdb234d283eb9 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: apply-tags + params: + - name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: apply-tags + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:3ab844157eccd68e95e4852adc06c3c4ea674edb7865a474b0a898227f2893d6 + - name: kind + value: task + resolver: bundles + - name: push-dockerfile + params: + - name: IMAGE + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: DOCKERFILE + value: $(params.dockerfile) + - name: CONTEXT + value: $(params.path-context) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: push-dockerfile-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:5a6cbebd89e5bc163b38231859767f7f6a0dd66cf1333699574379f062731183 + - name: kind + value: task + resolver: bundles + - name: rpms-signature-scan + params: + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: rpms-signature-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cc5133504ff03909ae970db81a986cb25a5532b2faf62a8ede5c60f28b716f54 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + workspaces: + - name: git-auth + optional: true + - name: netrc + optional: true + taskRunTemplate: + serviceAccountName: build-pipeline-functions-func + workspaces: + - name: git-auth + secret: + secretName: '{{ git_auth_secret }}' +status: {} diff --git a/.tekton/functions-func-push.yaml b/.tekton/functions-func-push.yaml new file mode 100644 index 0000000000..225824c3e2 --- /dev/null +++ b/.tekton/functions-func-push.yaml @@ -0,0 +1,578 @@ +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + annotations: + build.appstudio.openshift.io/repo: https://github.com/openshift/functions?rev={{revision}} + build.appstudio.redhat.com/commit_sha: '{{revision}}' + build.appstudio.redhat.com/target_branch: '{{target_branch}}' + pipelinesascode.tekton.dev/cancel-in-progress: "false" + pipelinesascode.tekton.dev/max-keep-runs: "3" + pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch + == "main" + labels: + appstudio.openshift.io/application: serverless-functions + appstudio.openshift.io/component: functions-func + pipelines.appstudio.openshift.io/type: build + name: functions-func-on-push + namespace: ocp-serverless-tenant +spec: + params: + - name: git-url + value: '{{source_url}}' + - name: revision + value: '{{revision}}' + - name: output-image + value: quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-func:{{revision}} + - name: build-platforms + value: + - linux/x86_64 + - name: dockerfile + value: Dockerfile.func.rhel9 + pipelineSpec: + description: | + This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. + + _Uses `buildah` to create a multi-platform container image leveraging [trusted artifacts](https://konflux-ci.dev/architecture/ADR/0036-trusted-artifacts.html). It also optionally creates a source image and runs some build-time tests. This pipeline requires that the [multi platform controller](https://github.com/konflux-ci/multi-platform-controller) is deployed and configured on your Konflux instance. Information is shared between tasks using OCI artifacts instead of PVCs. EC will pass the [`trusted_task.trusted`](https://conforma.dev/docs/policy/packages/release_trusted_task.html#trusted_task__trusted) policy as long as all data used to build the artifact is generated from trusted tasks. + This pipeline is pushed as a Tekton bundle to [quay.io](https://quay.io/repository/konflux-ci/tekton-catalog/pipeline-docker-build-multi-platform-oci-ta?tab=tags)_ + params: + - description: Source Repository URL + name: git-url + type: string + - default: "" + description: Revision of the Source Repository + name: revision + type: string + - description: Fully Qualified Output Image + name: output-image + type: string + - default: . + description: Path to the source code of an application's component from where + to build image. + name: path-context + type: string + - default: Dockerfile + description: Path to the Dockerfile inside the context specified by parameter + path-context + name: dockerfile + type: string + - default: "false" + description: Skip checks against built image + name: skip-checks + type: string + - default: "false" + description: Execute the build with network isolation + name: hermetic + type: string + - default: "" + description: Build dependencies to be prefetched + name: prefetch-input + type: string + - default: "" + description: Image tag expiration time, time values could be something like + 1h, 2d, 3w for hours, days, and weeks, respectively. + name: image-expires-after + type: string + - default: "false" + description: Build a source image. + name: build-source-image + type: string + - default: "true" + description: Add built image into an OCI image index + name: build-image-index + type: string + - default: docker + description: The format for the resulting image's mediaType. Valid values are + oci or docker. + name: buildah-format + type: string + - default: "false" + description: Enable cache proxy configuration + name: enable-cache-proxy + - default: "true" + description: Use the package registry proxy when prefetching dependencies + name: enable-package-registry-proxy + - default: . + description: Target directories in component's source code to scan with SAST + tools. Multiple values should be separated with commas. + name: sast-target-dirs + type: string + - default: [] + description: Array of --build-arg values ("arg=value" strings) for buildah + name: build-args + type: array + - default: "" + description: Path to a file with build arguments for buildah, see https://www.mankier.com/1/buildah-build#--build-arg-file + name: build-args-file + type: string + - default: "false" + description: Whether to enable privileged mode, should be used only with remote + VMs + name: privileged-nested + type: string + - default: "" + description: Sets the image created time and the SOURCE_DATE_EPOCH build argument. + On its own, it does not change file timestamps inside the layers (set rewrite-timestamp + to "true" for that). Leave empty to keep the actual build time. + name: source-date-epoch + type: string + - default: "false" + description: When "true", clamp file modification times in the image layers + to at most source-date-epoch. Does nothing unless source-date-epoch is set. + name: rewrite-timestamp + type: string + - default: "false" + description: When "true", omit the build history (history timestamps, layer + metadata, etc.) from the resulting image. + name: omit-history + type: string + - default: + - linux/x86_64 + description: List of platforms to build the container images on. The available + set of values is determined by the configuration of the multi-platform-controller. + name: build-platforms + type: array + results: + - description: "" + name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - description: "" + name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - description: "" + name: CHAINS-GIT_URL + value: $(tasks.clone-repository.results.url) + - description: "" + name: CHAINS-GIT_COMMIT + value: $(tasks.clone-repository.results.commit) + tasks: + - name: init + params: + - name: enable-cache-proxy + value: $(params.enable-cache-proxy) + taskRef: + params: + - name: name + value: init + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.2@sha256:421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db + - name: kind + value: task + resolver: bundles + - name: clone-repository + params: + - name: url + value: $(params.git-url) + - name: revision + value: $(params.revision) + - name: ociStorage + value: $(params.output-image).git + - name: ociArtifactExpiresAfter + value: $(params.image-expires-after) + runAfter: + - init + taskRef: + params: + - name: name + value: git-clone-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.4@sha256:df3c42d78223f07b40a84dd29e5c8860d14777ffdf150ea08c738770f51216dc + - name: kind + value: task + resolver: bundles + workspaces: + - name: basic-auth + workspace: git-auth + - name: prefetch-dependencies + params: + - name: input + value: $(params.prefetch-input) + - name: enable-package-registry-proxy + value: $(params.enable-package-registry-proxy) + - name: SOURCE_ARTIFACT + value: $(tasks.clone-repository.results.SOURCE_ARTIFACT) + - name: ociStorage + value: $(params.output-image).prefetch + - name: ociArtifactExpiresAfter + value: $(params.image-expires-after) + runAfter: + - clone-repository + taskRef: + params: + - name: name + value: prefetch-dependencies-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3.2@sha256:389aea03a065e8118d36b7acb85b05cd13f6750e7e10ff8a85f270ee65b0167b + - name: kind + value: task + resolver: bundles + workspaces: + - name: git-basic-auth + workspace: git-auth + - name: netrc + workspace: netrc + - matrix: + params: + - name: PLATFORM + value: + - $(params.build-platforms) + name: build-images + params: + - name: IMAGE + value: $(params.output-image) + - name: DOCKERFILE + value: $(params.dockerfile) + - name: CONTEXT + value: $(params.path-context) + - name: HERMETIC + value: $(params.hermetic) + - name: PREFETCH_INPUT + value: $(params.prefetch-input) + - name: IMAGE_EXPIRES_AFTER + value: $(params.image-expires-after) + - name: COMMIT_SHA + value: $(tasks.clone-repository.results.commit) + - name: BUILD_ARGS + value: + - $(params.build-args[*]) + - name: BUILD_ARGS_FILE + value: $(params.build-args-file) + - name: PRIVILEGED_NESTED + value: $(params.privileged-nested) + - name: SOURCE_URL + value: $(tasks.clone-repository.results.url) + - name: BUILDAH_FORMAT + value: $(params.buildah-format) + - name: HTTP_PROXY + value: $(tasks.init.results.http-proxy) + - name: NO_PROXY + value: $(tasks.init.results.no-proxy) + - name: SOURCE_DATE_EPOCH + value: $(params.source-date-epoch) + - name: REWRITE_TIMESTAMP + value: $(params.rewrite-timestamp) + - name: OMIT_HISTORY + value: $(params.omit-history) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + - name: IMAGE_APPEND_PLATFORM + value: "true" + runAfter: + - prefetch-dependencies + taskRef: + params: + - name: name + value: buildah-remote-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.10.5@sha256:eb277ec7b44443f0506a60ac940a2e52178d60f17cb0f51a6966daed5b3755de + - name: kind + value: task + resolver: bundles + - name: build-image-index + params: + - name: IMAGE + value: $(params.output-image) + - name: ALWAYS_BUILD_INDEX + value: $(params.build-image-index) + - name: IMAGES + value: + - $(tasks.build-images.results.IMAGE_REF[*]) + - name: BUILDAH_FORMAT + value: $(params.buildah-format) + runAfter: + - build-images + taskRef: + params: + - name: name + value: build-image-index + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:cc75f64deecccb1b59e96ac1182665a5342d79c9e22eebff63d26b0f00a4319c + - name: kind + value: task + resolver: bundles + - name: build-source-image + params: + - name: BINARY_IMAGE + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: BINARY_IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: source-build-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:7c5575ac8e292f27f57716c021ab0324460dc958e73946724c588c5228e5f372 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.build-source-image) + operator: in + values: + - "true" + - name: deprecated-base-image-check + params: + - name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: deprecated-image-check + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-deprecated-image-check:0.5@sha256:0ccc688a77e9b7b0b8973c132a1e840844137e77f887be4a0bec8893b0776872 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - matrix: + params: + - name: image-platform + value: + - $(params.build-platforms) + name: clair-scan + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: clair-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:f5b4415db9ac1fba3e11d993a617e0b275d1f0ed2fc669b12c400ed848c39174 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - matrix: + params: + - name: platform + value: + - $(params.build-platforms) + name: ecosystem-cert-preflight-checks + params: + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: ecosystem-cert-preflight-checks + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:42720a1e9ed1ef75b615a03e521d01e3ce7ca67c995366a374a58e1307986c58 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-snyk-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: TARGET_DIRS + value: $(params.sast-target-dirs) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-snyk-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:eba24f5d9f4b18aa71e523b9b3dbcf22982aa4b018824260a090b19dfc9abf6f + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - matrix: + params: + - name: image-arch + value: + - $(params.build-platforms) + name: clamav-scan + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: clamav-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-shell-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: TARGET_DIRS + value: $(params.sast-target-dirs) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-shell-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:61b27e6ad5daba761d41bb37efb790ed98380603fd4fe2f86d156def5bd72ecc + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: sast-unicode-check + params: + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: TARGET_DIRS + value: $(params.sast-target-dirs) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + - name: CACHI2_ARTIFACT + value: $(tasks.prefetch-dependencies.results.CACHI2_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: sast-unicode-check-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:eb9d5392f215cb8b52b16382098cac4885b1e6cd989f88ebd83fdb234d283eb9 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + - name: apply-tags + params: + - name: IMAGE_URL + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: apply-tags + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:3ab844157eccd68e95e4852adc06c3c4ea674edb7865a474b0a898227f2893d6 + - name: kind + value: task + resolver: bundles + - name: push-dockerfile + params: + - name: IMAGE + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: IMAGE_DIGEST + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + - name: DOCKERFILE + value: $(params.dockerfile) + - name: CONTEXT + value: $(params.path-context) + - name: SOURCE_ARTIFACT + value: $(tasks.prefetch-dependencies.results.SOURCE_ARTIFACT) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: push-dockerfile-oci-ta + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:5a6cbebd89e5bc163b38231859767f7f6a0dd66cf1333699574379f062731183 + - name: kind + value: task + resolver: bundles + - name: rpms-signature-scan + params: + - name: image-url + value: $(tasks.build-image-index.results.IMAGE_URL) + - name: image-digest + value: $(tasks.build-image-index.results.IMAGE_DIGEST) + runAfter: + - build-image-index + taskRef: + params: + - name: name + value: rpms-signature-scan + - name: bundle + value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cc5133504ff03909ae970db81a986cb25a5532b2faf62a8ede5c60f28b716f54 + - name: kind + value: task + resolver: bundles + when: + - input: $(params.skip-checks) + operator: in + values: + - "false" + workspaces: + - name: git-auth + optional: true + - name: netrc + optional: true + taskRunTemplate: + serviceAccountName: build-pipeline-functions-func + workspaces: + - name: git-auth + secret: + secretName: '{{ git_auth_secret }}' +status: {} From a73fa7eddc16b59c265c0c9c0ac7721e061c7d02 Mon Sep 17 00:00:00 2001 From: Marek Schmidt Date: Fri, 14 Aug 2026 14:58:15 +0200 Subject: [PATCH 15/38] update functions-func pipelines --- .tekton/functions-func-pull-request.yaml | 12 +++++++++++- .tekton/functions-func-push.yaml | 12 +++++++++++- 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/.tekton/functions-func-pull-request.yaml b/.tekton/functions-func-pull-request.yaml index 45867c3051..847afaf26d 100644 --- a/.tekton/functions-func-pull-request.yaml +++ b/.tekton/functions-func-pull-request.yaml @@ -9,7 +9,14 @@ metadata: pipelinesascode.tekton.dev/cancel-in-progress: "true" pipelinesascode.tekton.dev/max-keep-runs: "3" pipelinesascode.tekton.dev/on-cel-expression: event == "pull_request" && target_branch - == "main" + == "main" && ("Dockerfile.func.rhel9".pathChanged() + || "cmd/func/***".pathChanged() + || "pkg/***".pathChanged() + || "go.mod".pathChanged() + || "go.sum".pathChanged() + || "LICENSE".pathChanged() + || ".tekton/functions-func-push.yaml".pathChanged() + || ".tekton/functions-func-pull-request.yaml".pathChanged()) labels: appstudio.openshift.io/application: serverless-functions appstudio.openshift.io/component: functions-func @@ -29,6 +36,9 @@ spec: - name: build-platforms value: - linux/x86_64 + - linux/arm64 + - linux/s390x + - linux/ppc64le - name: dockerfile value: Dockerfile.func.rhel9 pipelineSpec: diff --git a/.tekton/functions-func-push.yaml b/.tekton/functions-func-push.yaml index 225824c3e2..e2056702c7 100644 --- a/.tekton/functions-func-push.yaml +++ b/.tekton/functions-func-push.yaml @@ -8,7 +8,14 @@ metadata: pipelinesascode.tekton.dev/cancel-in-progress: "false" pipelinesascode.tekton.dev/max-keep-runs: "3" pipelinesascode.tekton.dev/on-cel-expression: event == "push" && target_branch - == "main" + == "main" && ("Dockerfile.func.rhel9".pathChanged() + || "cmd/func/***".pathChanged() + || "pkg/***".pathChanged() + || "go.mod".pathChanged() + || "go.sum".pathChanged() + || "LICENSE".pathChanged() + || ".tekton/functions-func-push.yaml".pathChanged() + || ".tekton/functions-func-pull-request.yaml".pathChanged()) labels: appstudio.openshift.io/application: serverless-functions appstudio.openshift.io/component: functions-func @@ -26,6 +33,9 @@ spec: - name: build-platforms value: - linux/x86_64 + - linux/arm64 + - linux/s390x + - linux/ppc64le - name: dockerfile value: Dockerfile.func.rhel9 pipelineSpec: From 9da9c2296c0d55b652e4e0698331381482af6d7e Mon Sep 17 00:00:00 2001 From: Marek Schmidt Date: Fri, 14 Aug 2026 16:06:45 +0200 Subject: [PATCH 16/38] nudge utils --- Dockerfile.func.rhel9 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.func.rhel9 b/Dockerfile.func.rhel9 index f76f7628a8..3b47ef42af 100644 --- a/Dockerfile.func.rhel9 +++ b/Dockerfile.func.rhel9 @@ -4,7 +4,7 @@ ARG GO_RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal # Reference to the func-util image, baked into the func binary at build time # so it knows which image to use for in-cluster helper tasks (socat, tar, # deploy/scaffold/s2i pipeline steps). -ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:90bf0617eeb55c718f1ff9fb2af930330b3d609e8f07e9091965e351923f1329 +ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:a06bf3578e4573b2b7ac38dda05343eacec925114f7d2797a3581e67eec79d6c FROM $GO_BUILDER as builder From 1490e57ef964fec9c27f03a4aeeabc5e7a427a6a Mon Sep 17 00:00:00 2001 From: "red-hat-konflux-kflux-prd-rh02[bot]" <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> Date: Mon, 17 Aug 2026 07:09:41 +0000 Subject: [PATCH 17/38] Update functions-utils to 5ca7b28 Image created from 'https://github.com/openshift/functions?rev=118c473d4638a1715b48e40a41bde05acbaf036d' Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> --- Dockerfile.func.rhel9 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.func.rhel9 b/Dockerfile.func.rhel9 index 3b47ef42af..039a0d6123 100644 --- a/Dockerfile.func.rhel9 +++ b/Dockerfile.func.rhel9 @@ -4,7 +4,7 @@ ARG GO_RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal # Reference to the func-util image, baked into the func binary at build time # so it knows which image to use for in-cluster helper tasks (socat, tar, # deploy/scaffold/s2i pipeline steps). -ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:a06bf3578e4573b2b7ac38dda05343eacec925114f7d2797a3581e67eec79d6c +ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:5ca7b28d65ce25583cdf8041947b1c3dcbfb109093fc3db9e4907a2fd6c9f225 FROM $GO_BUILDER as builder From 5025ec6555483a6387c83118d2eb7a459c1d9258 Mon Sep 17 00:00:00 2001 From: "red-hat-konflux-kflux-prd-rh02[bot]" <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> Date: Mon, 17 Aug 2026 19:21:55 +0000 Subject: [PATCH 18/38] Update functions-utils to 6e6587f Image created from 'https://github.com/openshift/functions?rev=742703827838ea99d31ecc2620d4fd35594bfd09' Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> --- Dockerfile.func.rhel9 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.func.rhel9 b/Dockerfile.func.rhel9 index 039a0d6123..e75856884d 100644 --- a/Dockerfile.func.rhel9 +++ b/Dockerfile.func.rhel9 @@ -4,7 +4,7 @@ ARG GO_RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal # Reference to the func-util image, baked into the func binary at build time # so it knows which image to use for in-cluster helper tasks (socat, tar, # deploy/scaffold/s2i pipeline steps). -ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:5ca7b28d65ce25583cdf8041947b1c3dcbfb109093fc3db9e4907a2fd6c9f225 +ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:6e6587fdcaee4d344b4daa3b4d571bbc111253f1e8ff7e4594822a99754fa2a2 FROM $GO_BUILDER as builder From bbc50f1e066d72cf73c98ba5f9cbec6627b2006c Mon Sep 17 00:00:00 2001 From: David Fridrich Date: Mon, 10 Aug 2026 21:18:33 +0200 Subject: [PATCH 19/38] UPSTREAM: : Set default deployer to raw for OpenShift --- pkg/deployers/deployers.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/deployers/deployers.go b/pkg/deployers/deployers.go index a24af9302d..0188f9d38d 100644 --- a/pkg/deployers/deployers.go +++ b/pkg/deployers/deployers.go @@ -12,7 +12,7 @@ const ( Keda = "keda" // Default deployer absent any other configuration. - Default = Knative + Default = Kubernetes ) // ValidateSwitch reports an error if redeploying an already-deployed function From 84e6ec68a572a7849d68b6b6ad59d146ef3a16b3 Mon Sep 17 00:00:00 2001 From: "red-hat-konflux-kflux-prd-rh02[bot]" <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> Date: Tue, 18 Aug 2026 08:03:42 +0000 Subject: [PATCH 20/38] Update functions-utils to 1fca700 Image created from 'https://github.com/openshift/functions?rev=40da2bea5e098cfca6aa8639bc3812317f18aa4e' Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> --- Dockerfile.func.rhel9 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.func.rhel9 b/Dockerfile.func.rhel9 index e75856884d..80e479890f 100644 --- a/Dockerfile.func.rhel9 +++ b/Dockerfile.func.rhel9 @@ -4,7 +4,7 @@ ARG GO_RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal # Reference to the func-util image, baked into the func binary at build time # so it knows which image to use for in-cluster helper tasks (socat, tar, # deploy/scaffold/s2i pipeline steps). -ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:6e6587fdcaee4d344b4daa3b4d571bbc111253f1e8ff7e4594822a99754fa2a2 +ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:1fca7009dbd77c86cc5a46c666cfa27f98f63c8a01f8d11df71a64082f1aeebf FROM $GO_BUILDER as builder From 81d3b353da9e5ba909d98a3d9e15c30dd7256dfb Mon Sep 17 00:00:00 2001 From: Marek Schmidt Date: Thu, 20 Aug 2026 15:30:17 +0200 Subject: [PATCH 21/38] use ART-built golang builder for Konflux builds --- .tekton/functions-func-pull-request.yaml | 3 +++ .tekton/functions-func-push.yaml | 3 +++ .tekton/functions-utils-pull-request.yaml | 3 +++ .tekton/functions-utils-push.yaml | 3 +++ 4 files changed, 12 insertions(+) diff --git a/.tekton/functions-func-pull-request.yaml b/.tekton/functions-func-pull-request.yaml index 847afaf26d..22680f746e 100644 --- a/.tekton/functions-func-pull-request.yaml +++ b/.tekton/functions-func-pull-request.yaml @@ -41,6 +41,9 @@ spec: - linux/ppc64le - name: dockerfile value: Dockerfile.func.rhel9 + - name: build-args + value: + - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.26 pipelineSpec: description: | This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. diff --git a/.tekton/functions-func-push.yaml b/.tekton/functions-func-push.yaml index e2056702c7..dab652782c 100644 --- a/.tekton/functions-func-push.yaml +++ b/.tekton/functions-func-push.yaml @@ -38,6 +38,9 @@ spec: - linux/ppc64le - name: dockerfile value: Dockerfile.func.rhel9 + - name: build-args + value: + - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.26 pipelineSpec: description: | This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. diff --git a/.tekton/functions-utils-pull-request.yaml b/.tekton/functions-utils-pull-request.yaml index e4801fc96e..ec56b8ec43 100644 --- a/.tekton/functions-utils-pull-request.yaml +++ b/.tekton/functions-utils-pull-request.yaml @@ -41,6 +41,9 @@ spec: - linux/ppc64le - name: dockerfile value: ./Dockerfile.utils.rhel9 + - name: build-args + value: + - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.26 pipelineSpec: description: | This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. diff --git a/.tekton/functions-utils-push.yaml b/.tekton/functions-utils-push.yaml index c641395918..33d5a54ae1 100644 --- a/.tekton/functions-utils-push.yaml +++ b/.tekton/functions-utils-push.yaml @@ -38,6 +38,9 @@ spec: - linux/ppc64le - name: dockerfile value: ./Dockerfile.utils.rhel9 + - name: build-args + value: + - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.26 pipelineSpec: description: | This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. From 3548360450cc0e4d5ef40d508b850aa938f68c06 Mon Sep 17 00:00:00 2001 From: "red-hat-konflux-kflux-prd-rh02[bot]" <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> Date: Thu, 20 Aug 2026 13:59:42 +0000 Subject: [PATCH 22/38] Update functions-utils to 4e2ba9f Image created from 'https://github.com/openshift/functions?rev=5e01e567a732197e7c334aa9d32e030ef59898dd' Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> --- Dockerfile.func.rhel9 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.func.rhel9 b/Dockerfile.func.rhel9 index 80e479890f..b2fc79ba69 100644 --- a/Dockerfile.func.rhel9 +++ b/Dockerfile.func.rhel9 @@ -4,7 +4,7 @@ ARG GO_RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal # Reference to the func-util image, baked into the func binary at build time # so it knows which image to use for in-cluster helper tasks (socat, tar, # deploy/scaffold/s2i pipeline steps). -ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:1fca7009dbd77c86cc5a46c666cfa27f98f63c8a01f8d11df71a64082f1aeebf +ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:4e2ba9fff37538c292da3444ef818b3d268fd10f3b98c2d890d0517d0f2ac8ae FROM $GO_BUILDER as builder From d7bb07fc6830b49086103ebc53e8aea5224e5d1f Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Thu, 20 Aug 2026 15:12:09 +0000 Subject: [PATCH 23/38] Enable cachi2/Hermeto prefetch for hermetic Konflux builds Update Dockerfiles and Tekton PipelineRun definitions to support hermetic builds with cachi2 dependency prefetching. Dockerfile changes (func and utils): - Source /cachi2/cachi2.env before go build when available, setting GOPROXY and GOMODCACHE to use prefetched dependencies. The conditional check ensures non-hermetic builds continue to work unchanged. Tekton pipeline changes (all 4 PipelineRuns): - Add prefetch-input parameter with gomod type to prefetch Go module dependencies before the build. - Set hermetic parameter to "true" to enable network-isolated builds. - build-args with GO_BUILDER Brew image override was already present. Co-Authored-By: Claude Opus 4.6 --- .tekton/functions-func-pull-request.yaml | 4 ++++ .tekton/functions-func-push.yaml | 4 ++++ .tekton/functions-utils-pull-request.yaml | 4 ++++ .tekton/functions-utils-push.yaml | 4 ++++ Dockerfile.func.rhel9 | 3 ++- Dockerfile.utils.rhel9 | 3 ++- 6 files changed, 20 insertions(+), 2 deletions(-) diff --git a/.tekton/functions-func-pull-request.yaml b/.tekton/functions-func-pull-request.yaml index 22680f746e..9357774d8e 100644 --- a/.tekton/functions-func-pull-request.yaml +++ b/.tekton/functions-func-pull-request.yaml @@ -44,6 +44,10 @@ spec: - name: build-args value: - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.26 + - name: prefetch-input + value: '{"type": "gomod", "path": "."}' + - name: hermetic + value: "true" pipelineSpec: description: | This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. diff --git a/.tekton/functions-func-push.yaml b/.tekton/functions-func-push.yaml index dab652782c..5ab480b5ef 100644 --- a/.tekton/functions-func-push.yaml +++ b/.tekton/functions-func-push.yaml @@ -41,6 +41,10 @@ spec: - name: build-args value: - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.26 + - name: prefetch-input + value: '{"type": "gomod", "path": "."}' + - name: hermetic + value: "true" pipelineSpec: description: | This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. diff --git a/.tekton/functions-utils-pull-request.yaml b/.tekton/functions-utils-pull-request.yaml index ec56b8ec43..9025ef7a48 100644 --- a/.tekton/functions-utils-pull-request.yaml +++ b/.tekton/functions-utils-pull-request.yaml @@ -44,6 +44,10 @@ spec: - name: build-args value: - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.26 + - name: prefetch-input + value: '{"type": "gomod", "path": "."}' + - name: hermetic + value: "true" pipelineSpec: description: | This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. diff --git a/.tekton/functions-utils-push.yaml b/.tekton/functions-utils-push.yaml index 33d5a54ae1..6dfc579069 100644 --- a/.tekton/functions-utils-push.yaml +++ b/.tekton/functions-utils-push.yaml @@ -41,6 +41,10 @@ spec: - name: build-args value: - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.26 + - name: prefetch-input + value: '{"type": "gomod", "path": "."}' + - name: hermetic + value: "true" pipelineSpec: description: | This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. diff --git a/Dockerfile.func.rhel9 b/Dockerfile.func.rhel9 index b2fc79ba69..582c2cbbd1 100644 --- a/Dockerfile.func.rhel9 +++ b/Dockerfile.func.rhel9 @@ -17,7 +17,8 @@ ENV CGO_ENABLED=1 ENV GOEXPERIMENT=strictfipsruntime ENV GOFLAGS='' -RUN go build -tags strictfipsruntime,exclude_graphdriver_btrfs \ +RUN if [ -f /cachi2/cachi2.env ]; then source /cachi2/cachi2.env; fi && \ + go build -tags strictfipsruntime,exclude_graphdriver_btrfs \ -ldflags "-X knative.dev/func/pkg/k8s.SocatImage=$FUNC_UTILS_IMG \ -X knative.dev/func/pkg/k8s.TarImage=$FUNC_UTILS_IMG \ -X knative.dev/func/pkg/pipelines/tekton.FuncUtilImage=$FUNC_UTILS_IMG" \ diff --git a/Dockerfile.utils.rhel9 b/Dockerfile.utils.rhel9 index b2071f7cf2..455b8f967e 100755 --- a/Dockerfile.utils.rhel9 +++ b/Dockerfile.utils.rhel9 @@ -10,7 +10,8 @@ ENV CGO_ENABLED=1 ENV GOEXPERIMENT=strictfipsruntime ENV GOFLAGS='' -RUN go build -tags strictfipsruntime,exclude_graphdriver_btrfs -o /usr/bin/main ./cmd/func-util +RUN if [ -f /cachi2/cachi2.env ]; then source /cachi2/cachi2.env; fi && \ + go build -tags strictfipsruntime,exclude_graphdriver_btrfs -o /usr/bin/main ./cmd/func-util FROM $GO_RUNTIME From 860b6d226cadb774b56f3432f70790cadb13a97a Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Thu, 20 Aug 2026 16:10:22 +0000 Subject: [PATCH 24/38] Add RPM prefetch support for hermetic functions-utils builds Add rpms.in.yaml listing the socat and tar packages installed by Dockerfile.utils.rhel9, along with the UBI 9 repo configuration (redhat.repo) extracted from the ubi9/ubi-minimal base image and the generated rpms.lock.yaml lockfile. Update the prefetch-input in the functions-utils Tekton pipelines (push and pull-request) to combine gomod and rpm prefetch types. The functions-func pipelines are left unchanged as Dockerfile.func.rhel9 does not install any RPM packages. The lockfile was generated with: rpm-lockfile-prototype --image registry.access.redhat.com/ubi9/ubi-minimal rpms.in.yaml Co-Authored-By: Claude Opus 4.6 --- .tekton/functions-utils-pull-request.yaml | 2 +- .tekton/functions-utils-push.yaml | 2 +- redhat.repo | 62 ++++++++++++++++++ rpms.in.yaml | 13 ++++ rpms.lock.yaml | 76 +++++++++++++++++++++++ 5 files changed, 153 insertions(+), 2 deletions(-) create mode 100644 redhat.repo create mode 100644 rpms.in.yaml create mode 100644 rpms.lock.yaml diff --git a/.tekton/functions-utils-pull-request.yaml b/.tekton/functions-utils-pull-request.yaml index 9025ef7a48..0aa71edde3 100644 --- a/.tekton/functions-utils-pull-request.yaml +++ b/.tekton/functions-utils-pull-request.yaml @@ -45,7 +45,7 @@ spec: value: - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.26 - name: prefetch-input - value: '{"type": "gomod", "path": "."}' + value: '[{"type": "gomod", "path": "."}, {"type": "rpm"}]' - name: hermetic value: "true" pipelineSpec: diff --git a/.tekton/functions-utils-push.yaml b/.tekton/functions-utils-push.yaml index 6dfc579069..fbc5bce99b 100644 --- a/.tekton/functions-utils-push.yaml +++ b/.tekton/functions-utils-push.yaml @@ -42,7 +42,7 @@ spec: value: - GO_BUILDER=brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.26 - name: prefetch-input - value: '{"type": "gomod", "path": "."}' + value: '[{"type": "gomod", "path": "."}, {"type": "rpm"}]' - name: hermetic value: "true" pipelineSpec: diff --git a/redhat.repo b/redhat.repo new file mode 100644 index 0000000000..aa4f953497 --- /dev/null +++ b/redhat.repo @@ -0,0 +1,62 @@ +[ubi-9-baseos-rpms] +name = Red Hat Universal Base Image 9 (RPMs) - BaseOS +baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/baseos/os +enabled = 1 +gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release +gpgcheck = 1 + +[ubi-9-baseos-debug-rpms] +name = Red Hat Universal Base Image 9 (Debug RPMs) - BaseOS +baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/baseos/debug +enabled = 0 +gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release +gpgcheck = 1 + +[ubi-9-baseos-source-rpms] +name = Red Hat Universal Base Image 9 (Source RPMs) - BaseOS +baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/baseos/source/SRPMS +enabled = 0 +gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release +gpgcheck = 1 + +[ubi-9-appstream-rpms] +name = Red Hat Universal Base Image 9 (RPMs) - AppStream +baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/appstream/os +enabled = 1 +gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release +gpgcheck = 1 + +[ubi-9-appstream-debug-rpms] +name = Red Hat Universal Base Image 9 (Debug RPMs) - AppStream +baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/appstream/debug +enabled = 0 +gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release +gpgcheck = 1 + +[ubi-9-appstream-source-rpms] +name = Red Hat Universal Base Image 9 (Source RPMs) - AppStream +baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/appstream/source/SRPMS +enabled = 0 +gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release +gpgcheck = 1 + +[ubi-9-codeready-builder-rpms] +name = Red Hat Universal Base Image 9 (RPMs) - CodeReady Builder +baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/codeready-builder/os +enabled = 1 +gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release +gpgcheck = 1 + +[ubi-9-codeready-builder-debug-rpms] +name = Red Hat Universal Base Image 9 (Debug RPMs) - CodeReady Builder +baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/codeready-builder/debug +enabled = 0 +gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release +gpgcheck = 1 + +[ubi-9-codeready-builder-source-rpms] +name = Red Hat Universal Base Image 9 (Source RPMs) - CodeReady Builder +baseurl = https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/$basearch/codeready-builder/source/SRPMS +enabled = 0 +gpgkey = file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release +gpgcheck = 1 diff --git a/rpms.in.yaml b/rpms.in.yaml new file mode 100644 index 0000000000..42187ab863 --- /dev/null +++ b/rpms.in.yaml @@ -0,0 +1,13 @@ +contentOrigin: + repofiles: + - ./redhat.repo +context: + image: registry.access.redhat.com/ubi9/ubi-minimal +packages: + - socat + - tar +arches: + - x86_64 + - aarch64 + - s390x + - ppc64le diff --git a/rpms.lock.yaml b/rpms.lock.yaml new file mode 100644 index 0000000000..12b22f787a --- /dev/null +++ b/rpms.lock.yaml @@ -0,0 +1,76 @@ +--- +lockfileVersion: 1 +lockfileVendor: redhat +arches: +- arch: aarch64 + packages: + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/appstream/os/Packages/s/socat-1.7.4.1-8.el9.aarch64.rpm + repoid: ubi-9-appstream-rpms + size: 307483 + checksum: sha256:4c98bfb9ce0f972e133e7f1ec547e0f87dd901f5213b7e59eafd9befed843884 + name: socat + evr: 1.7.4.1-8.el9 + sourcerpm: socat-1.7.4.1-8.el9.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/t/tar-1.34-11.el9.aarch64.rpm + repoid: ubi-9-baseos-rpms + size: 904777 + checksum: sha256:62f985a87e048caa3ef883966d6176448398abc42df00ebff07e7311ff5f425d + name: tar + evr: 2:1.34-11.el9 + sourcerpm: tar-1.34-11.el9.src.rpm + source: [] + module_metadata: [] +- arch: ppc64le + packages: + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/appstream/os/Packages/s/socat-1.7.4.1-8.el9.ppc64le.rpm + repoid: ubi-9-appstream-rpms + size: 319998 + checksum: sha256:224f47b0e5a9757cc7df97d56910d3bbe9580bbedf7e1d20dd965cabdc5c7b58 + name: socat + evr: 1.7.4.1-8.el9 + sourcerpm: socat-1.7.4.1-8.el9.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/baseos/os/Packages/t/tar-1.34-11.el9.ppc64le.rpm + repoid: ubi-9-baseos-rpms + size: 945887 + checksum: sha256:cb2fe4ca6c89e1a9fff648629cc7b9b7f33a7853a8ae74c10baa1d5b731d2447 + name: tar + evr: 2:1.34-11.el9 + sourcerpm: tar-1.34-11.el9.src.rpm + source: [] + module_metadata: [] +- arch: s390x + packages: + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/appstream/os/Packages/s/socat-1.7.4.1-8.el9.s390x.rpm + repoid: ubi-9-appstream-rpms + size: 304464 + checksum: sha256:78b7afbffcd7072e7389cfa8a42131da19beaaac1c19af264c7d8a0150ae5077 + name: socat + evr: 1.7.4.1-8.el9 + sourcerpm: socat-1.7.4.1-8.el9.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/baseos/os/Packages/t/tar-1.34-11.el9.s390x.rpm + repoid: ubi-9-baseos-rpms + size: 907745 + checksum: sha256:2eee88e1c470b033bd44432f4ed5b1a41ffc7132ebe51f8ce12fa9268314e841 + name: tar + evr: 2:1.34-11.el9 + sourcerpm: tar-1.34-11.el9.src.rpm + source: [] + module_metadata: [] +- arch: x86_64 + packages: + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/appstream/os/Packages/s/socat-1.7.4.1-8.el9.x86_64.rpm + repoid: ubi-9-appstream-rpms + size: 310557 + checksum: sha256:eca1948f706239e3716f721ec077f94afb733c42976fba6e475924a4e3b603aa + name: socat + evr: 1.7.4.1-8.el9 + sourcerpm: socat-1.7.4.1-8.el9.src.rpm + - url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/t/tar-1.34-11.el9.x86_64.rpm + repoid: ubi-9-baseos-rpms + size: 913256 + checksum: sha256:58b622ab7bc225731a2473e677f16c9eb51b1ed218a86a7aa039a6fed665f245 + name: tar + evr: 2:1.34-11.el9 + sourcerpm: tar-1.34-11.el9.src.rpm + source: [] + module_metadata: [] From 126893ac9b4ee1ff084d96b360b1ac6d441e892c Mon Sep 17 00:00:00 2001 From: Marek Schmidt Date: Thu, 20 Aug 2026 19:09:43 +0200 Subject: [PATCH 25/38] add renovate for refresh-rpm-lockfiles --- renovate.json | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 renovate.json diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000000..83ad6e7542 --- /dev/null +++ b/renovate.json @@ -0,0 +1,5 @@ +{ + "extends": [ + "github>konflux-ci/mintmaker-presets:refresh-rpm-lockfiles" + ] +} From 91bf30a9c21d7d245ca6b64bd755d5fd446321a6 Mon Sep 17 00:00:00 2001 From: "red-hat-konflux-kflux-prd-rh02[bot]" <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> Date: Thu, 20 Aug 2026 17:15:32 +0000 Subject: [PATCH 26/38] Update functions-utils to 447c642 Image created from 'https://github.com/openshift/functions?rev=75af9b2ec178992c374e463176a31a108543d576' Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> --- Dockerfile.func.rhel9 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.func.rhel9 b/Dockerfile.func.rhel9 index 582c2cbbd1..d107028025 100644 --- a/Dockerfile.func.rhel9 +++ b/Dockerfile.func.rhel9 @@ -4,7 +4,7 @@ ARG GO_RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal # Reference to the func-util image, baked into the func binary at build time # so it knows which image to use for in-cluster helper tasks (socat, tar, # deploy/scaffold/s2i pipeline steps). -ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:4e2ba9fff37538c292da3444ef818b3d268fd10f3b98c2d890d0517d0f2ac8ae +ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:447c64264a98b492bfc87a399910579d8da7e87860c6c2f311ea2ec660620602 FROM $GO_BUILDER as builder From 628d240ae96b0237f86d9de05d526b74888da71e Mon Sep 17 00:00:00 2001 From: Chai Bot Date: Fri, 21 Aug 2026 06:41:40 +0000 Subject: [PATCH 27/38] Disable go.mod and templates/ lock file updates in Renovate Co-Authored-By: Claude Opus 4.6 --- renovate.json | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index 83ad6e7542..e9d1d98c03 100644 --- a/renovate.json +++ b/renovate.json @@ -1,5 +1,11 @@ { "extends": [ "github>konflux-ci/mintmaker-presets:refresh-rpm-lockfiles" - ] + ], + "ignorePaths": [ + "templates/**" + ], + "gomod": { + "enabled": false + } } From ce459ff7eff1776fa2e28e12d8c6e0fc8df2f5f6 Mon Sep 17 00:00:00 2001 From: "red-hat-konflux-kflux-prd-rh02[bot]" <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> Date: Fri, 21 Aug 2026 08:03:18 +0000 Subject: [PATCH 28/38] Update actions/cache action to v3.5.0 Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> --- .../go-retryablehttp/.github/workflows/go-retryablehttp.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/third_party/VENDOR-LICENSE/github.com/hashicorp/go-retryablehttp/.github/workflows/go-retryablehttp.yml b/third_party/VENDOR-LICENSE/github.com/hashicorp/go-retryablehttp/.github/workflows/go-retryablehttp.yml index dad25d8184..399605cc8c 100644 --- a/third_party/VENDOR-LICENSE/github.com/hashicorp/go-retryablehttp/.github/workflows/go-retryablehttp.yml +++ b/third_party/VENDOR-LICENSE/github.com/hashicorp/go-retryablehttp/.github/workflows/go-retryablehttp.yml @@ -14,7 +14,7 @@ jobs: - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0 - run: mkdir -p "$TEST_RESULTS"/go-retryablyhttp - name: restore_cache - uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3.2.6 + uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0 with: key: go-mod-v1-{{ checksum "go.sum" }} restore-keys: go-mod-v1-{{ checksum "go.sum" }} From 82481831cda675c2272adaef85b8355aa917c4e1 Mon Sep 17 00:00:00 2001 From: Marek Schmidt Date: Fri, 21 Aug 2026 11:48:14 +0200 Subject: [PATCH 29/38] ignore third_party/ --- renovate.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index e9d1d98c03..4e6fb1e33c 100644 --- a/renovate.json +++ b/renovate.json @@ -3,7 +3,8 @@ "github>konflux-ci/mintmaker-presets:refresh-rpm-lockfiles" ], "ignorePaths": [ - "templates/**" + "templates/**", + "third_party/**" ], "gomod": { "enabled": false From 5d9ee85dd04e58b022edc74842e0aa824d2887af Mon Sep 17 00:00:00 2001 From: "red-hat-konflux-kflux-prd-rh02[bot]" <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> Date: Sat, 22 Aug 2026 08:04:10 +0000 Subject: [PATCH 30/38] Update Konflux references Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> --- .tekton/functions-func-pull-request.yaml | 30 +++++++++++------------ .tekton/functions-func-push.yaml | 30 +++++++++++------------ .tekton/functions-utils-pull-request.yaml | 30 +++++++++++------------ .tekton/functions-utils-push.yaml | 30 +++++++++++------------ 4 files changed, 60 insertions(+), 60 deletions(-) diff --git a/.tekton/functions-func-pull-request.yaml b/.tekton/functions-func-pull-request.yaml index 9357774d8e..3858c7b675 100644 --- a/.tekton/functions-func-pull-request.yaml +++ b/.tekton/functions-func-pull-request.yaml @@ -174,7 +174,7 @@ spec: - name: name value: init - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.2@sha256:421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db + value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.3@sha256:5f687152ab0661f84830877de93a8ec45cb0b756f71b24ac55133d03a4007936 - name: kind value: task resolver: bundles @@ -195,7 +195,7 @@ spec: - name: name value: git-clone-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.4@sha256:df3c42d78223f07b40a84dd29e5c8860d14777ffdf150ea08c738770f51216dc + value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:3bcd4c39a346d29617013f4c47d245d38f020cdbf814cf3ce095911c528f5003 - name: kind value: task resolver: bundles @@ -221,7 +221,7 @@ spec: - name: name value: prefetch-dependencies-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3.2@sha256:389aea03a065e8118d36b7acb85b05cd13f6750e7e10ff8a85f270ee65b0167b + value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.10.1@sha256:c09c1c3ced67fb8740b2925a7de09c0810d4e8c8f148d41c21ffe37810d85c62 - name: kind value: task resolver: bundles @@ -285,7 +285,7 @@ spec: - name: name value: buildah-remote-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.10.5@sha256:eb277ec7b44443f0506a60ac940a2e52178d60f17cb0f51a6966daed5b3755de + value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.12.0@sha256:44c1ca2e823f006ee94e066231b033b191f0f8cee51add1e908138335eba9b30 - name: kind value: task resolver: bundles @@ -307,7 +307,7 @@ spec: - name: name value: build-image-index - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:cc75f64deecccb1b59e96ac1182665a5342d79c9e22eebff63d26b0f00a4319c + value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:c2cda69e681c976dd5b39caf6682d1c8f8c5e5a53a67a22a5b06d4cde773bd10 - name: kind value: task resolver: bundles @@ -328,7 +328,7 @@ spec: - name: name value: source-build-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:7c5575ac8e292f27f57716c021ab0324460dc958e73946724c588c5228e5f372 + value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:6bb2697f8f194a6a644b8b861489ce8b1c5ba16a7d55dbd8e66a0c98d06dfc1c - name: kind value: task resolver: bundles @@ -377,7 +377,7 @@ spec: - name: name value: clair-scan - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:f5b4415db9ac1fba3e11d993a617e0b275d1f0ed2fc669b12c400ed848c39174 + value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.4.0@sha256:dcc6ca58d3ec03d05ce21c03b4f51b58cac9878caa932ad06a9fdf4bc422aaab - name: kind value: task resolver: bundles @@ -402,7 +402,7 @@ spec: - name: name value: ecosystem-cert-preflight-checks - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:42720a1e9ed1ef75b615a03e521d01e3ce7ca67c995366a374a58e1307986c58 + value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:4619769705d4999e129b779d7699d89d33c47f7ab80d73ad6e3dcd8a6a4e43a7 - name: kind value: task resolver: bundles @@ -430,7 +430,7 @@ spec: - name: name value: sast-snyk-check-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:eba24f5d9f4b18aa71e523b9b3dbcf22982aa4b018824260a090b19dfc9abf6f + value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:b78e9c05c5126613eddee53f2f3534a9b86bfca17d903599f2fa465b7938e241 - name: kind value: task resolver: bundles @@ -457,7 +457,7 @@ spec: - name: name value: clamav-scan - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217 + value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3.1@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217 - name: kind value: task resolver: bundles @@ -485,7 +485,7 @@ spec: - name: name value: sast-shell-check-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:61b27e6ad5daba761d41bb37efb790ed98380603fd4fe2f86d156def5bd72ecc + value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:beb05ae2fad733783b3b17e05871e0eaf527a07c904cf3fb2cb551025007eec1 - name: kind value: task resolver: bundles @@ -513,7 +513,7 @@ spec: - name: name value: sast-unicode-check-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:eb9d5392f215cb8b52b16382098cac4885b1e6cd989f88ebd83fdb234d283eb9 + value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:d09f717cb84f0699a531773bc498745deef2c006a81918aa73b3be6d2f4778bd - name: kind value: task resolver: bundles @@ -535,7 +535,7 @@ spec: - name: name value: apply-tags - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:3ab844157eccd68e95e4852adc06c3c4ea674edb7865a474b0a898227f2893d6 + value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:2dae3c4beaf1070db565c536bc997e93925ae8c0c45dd8da9b4ae5293fd8c592 - name: kind value: task resolver: bundles @@ -558,7 +558,7 @@ spec: - name: name value: push-dockerfile-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:5a6cbebd89e5bc163b38231859767f7f6a0dd66cf1333699574379f062731183 + value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:393b4d0b530c2657b3ff6fec714781f4938b95b699dea2b369442b7664e1cce2 - name: kind value: task resolver: bundles @@ -575,7 +575,7 @@ spec: - name: name value: rpms-signature-scan - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cc5133504ff03909ae970db81a986cb25a5532b2faf62a8ede5c60f28b716f54 + value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2.1@sha256:538a853c4a299216c43258ccc9894215f5440dc0c70c9c99fe22fc9633a8e79d - name: kind value: task resolver: bundles diff --git a/.tekton/functions-func-push.yaml b/.tekton/functions-func-push.yaml index 5ab480b5ef..cbd4d9890f 100644 --- a/.tekton/functions-func-push.yaml +++ b/.tekton/functions-func-push.yaml @@ -171,7 +171,7 @@ spec: - name: name value: init - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.2@sha256:421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db + value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.3@sha256:5f687152ab0661f84830877de93a8ec45cb0b756f71b24ac55133d03a4007936 - name: kind value: task resolver: bundles @@ -192,7 +192,7 @@ spec: - name: name value: git-clone-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.4@sha256:df3c42d78223f07b40a84dd29e5c8860d14777ffdf150ea08c738770f51216dc + value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:3bcd4c39a346d29617013f4c47d245d38f020cdbf814cf3ce095911c528f5003 - name: kind value: task resolver: bundles @@ -218,7 +218,7 @@ spec: - name: name value: prefetch-dependencies-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3.2@sha256:389aea03a065e8118d36b7acb85b05cd13f6750e7e10ff8a85f270ee65b0167b + value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.10.1@sha256:c09c1c3ced67fb8740b2925a7de09c0810d4e8c8f148d41c21ffe37810d85c62 - name: kind value: task resolver: bundles @@ -282,7 +282,7 @@ spec: - name: name value: buildah-remote-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.10.5@sha256:eb277ec7b44443f0506a60ac940a2e52178d60f17cb0f51a6966daed5b3755de + value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.12.0@sha256:44c1ca2e823f006ee94e066231b033b191f0f8cee51add1e908138335eba9b30 - name: kind value: task resolver: bundles @@ -304,7 +304,7 @@ spec: - name: name value: build-image-index - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:cc75f64deecccb1b59e96ac1182665a5342d79c9e22eebff63d26b0f00a4319c + value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:c2cda69e681c976dd5b39caf6682d1c8f8c5e5a53a67a22a5b06d4cde773bd10 - name: kind value: task resolver: bundles @@ -325,7 +325,7 @@ spec: - name: name value: source-build-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:7c5575ac8e292f27f57716c021ab0324460dc958e73946724c588c5228e5f372 + value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:6bb2697f8f194a6a644b8b861489ce8b1c5ba16a7d55dbd8e66a0c98d06dfc1c - name: kind value: task resolver: bundles @@ -374,7 +374,7 @@ spec: - name: name value: clair-scan - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:f5b4415db9ac1fba3e11d993a617e0b275d1f0ed2fc669b12c400ed848c39174 + value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.4.0@sha256:dcc6ca58d3ec03d05ce21c03b4f51b58cac9878caa932ad06a9fdf4bc422aaab - name: kind value: task resolver: bundles @@ -399,7 +399,7 @@ spec: - name: name value: ecosystem-cert-preflight-checks - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:42720a1e9ed1ef75b615a03e521d01e3ce7ca67c995366a374a58e1307986c58 + value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:4619769705d4999e129b779d7699d89d33c47f7ab80d73ad6e3dcd8a6a4e43a7 - name: kind value: task resolver: bundles @@ -427,7 +427,7 @@ spec: - name: name value: sast-snyk-check-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:eba24f5d9f4b18aa71e523b9b3dbcf22982aa4b018824260a090b19dfc9abf6f + value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:b78e9c05c5126613eddee53f2f3534a9b86bfca17d903599f2fa465b7938e241 - name: kind value: task resolver: bundles @@ -454,7 +454,7 @@ spec: - name: name value: clamav-scan - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217 + value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3.1@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217 - name: kind value: task resolver: bundles @@ -482,7 +482,7 @@ spec: - name: name value: sast-shell-check-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:61b27e6ad5daba761d41bb37efb790ed98380603fd4fe2f86d156def5bd72ecc + value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:beb05ae2fad733783b3b17e05871e0eaf527a07c904cf3fb2cb551025007eec1 - name: kind value: task resolver: bundles @@ -510,7 +510,7 @@ spec: - name: name value: sast-unicode-check-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:eb9d5392f215cb8b52b16382098cac4885b1e6cd989f88ebd83fdb234d283eb9 + value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:d09f717cb84f0699a531773bc498745deef2c006a81918aa73b3be6d2f4778bd - name: kind value: task resolver: bundles @@ -532,7 +532,7 @@ spec: - name: name value: apply-tags - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:3ab844157eccd68e95e4852adc06c3c4ea674edb7865a474b0a898227f2893d6 + value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:2dae3c4beaf1070db565c536bc997e93925ae8c0c45dd8da9b4ae5293fd8c592 - name: kind value: task resolver: bundles @@ -555,7 +555,7 @@ spec: - name: name value: push-dockerfile-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:5a6cbebd89e5bc163b38231859767f7f6a0dd66cf1333699574379f062731183 + value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:393b4d0b530c2657b3ff6fec714781f4938b95b699dea2b369442b7664e1cce2 - name: kind value: task resolver: bundles @@ -572,7 +572,7 @@ spec: - name: name value: rpms-signature-scan - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cc5133504ff03909ae970db81a986cb25a5532b2faf62a8ede5c60f28b716f54 + value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2.1@sha256:538a853c4a299216c43258ccc9894215f5440dc0c70c9c99fe22fc9633a8e79d - name: kind value: task resolver: bundles diff --git a/.tekton/functions-utils-pull-request.yaml b/.tekton/functions-utils-pull-request.yaml index 0aa71edde3..363e81ab36 100644 --- a/.tekton/functions-utils-pull-request.yaml +++ b/.tekton/functions-utils-pull-request.yaml @@ -174,7 +174,7 @@ spec: - name: name value: init - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.2@sha256:421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db + value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.3@sha256:5f687152ab0661f84830877de93a8ec45cb0b756f71b24ac55133d03a4007936 - name: kind value: task resolver: bundles @@ -195,7 +195,7 @@ spec: - name: name value: git-clone-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.4@sha256:df3c42d78223f07b40a84dd29e5c8860d14777ffdf150ea08c738770f51216dc + value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:3bcd4c39a346d29617013f4c47d245d38f020cdbf814cf3ce095911c528f5003 - name: kind value: task resolver: bundles @@ -221,7 +221,7 @@ spec: - name: name value: prefetch-dependencies-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3.2@sha256:389aea03a065e8118d36b7acb85b05cd13f6750e7e10ff8a85f270ee65b0167b + value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.10.1@sha256:c09c1c3ced67fb8740b2925a7de09c0810d4e8c8f148d41c21ffe37810d85c62 - name: kind value: task resolver: bundles @@ -285,7 +285,7 @@ spec: - name: name value: buildah-remote-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.10.5@sha256:eb277ec7b44443f0506a60ac940a2e52178d60f17cb0f51a6966daed5b3755de + value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.12.0@sha256:44c1ca2e823f006ee94e066231b033b191f0f8cee51add1e908138335eba9b30 - name: kind value: task resolver: bundles @@ -307,7 +307,7 @@ spec: - name: name value: build-image-index - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:cc75f64deecccb1b59e96ac1182665a5342d79c9e22eebff63d26b0f00a4319c + value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:c2cda69e681c976dd5b39caf6682d1c8f8c5e5a53a67a22a5b06d4cde773bd10 - name: kind value: task resolver: bundles @@ -328,7 +328,7 @@ spec: - name: name value: source-build-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:7c5575ac8e292f27f57716c021ab0324460dc958e73946724c588c5228e5f372 + value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:6bb2697f8f194a6a644b8b861489ce8b1c5ba16a7d55dbd8e66a0c98d06dfc1c - name: kind value: task resolver: bundles @@ -377,7 +377,7 @@ spec: - name: name value: clair-scan - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:f5b4415db9ac1fba3e11d993a617e0b275d1f0ed2fc669b12c400ed848c39174 + value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.4.0@sha256:dcc6ca58d3ec03d05ce21c03b4f51b58cac9878caa932ad06a9fdf4bc422aaab - name: kind value: task resolver: bundles @@ -402,7 +402,7 @@ spec: - name: name value: ecosystem-cert-preflight-checks - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:42720a1e9ed1ef75b615a03e521d01e3ce7ca67c995366a374a58e1307986c58 + value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:4619769705d4999e129b779d7699d89d33c47f7ab80d73ad6e3dcd8a6a4e43a7 - name: kind value: task resolver: bundles @@ -430,7 +430,7 @@ spec: - name: name value: sast-snyk-check-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:eba24f5d9f4b18aa71e523b9b3dbcf22982aa4b018824260a090b19dfc9abf6f + value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:b78e9c05c5126613eddee53f2f3534a9b86bfca17d903599f2fa465b7938e241 - name: kind value: task resolver: bundles @@ -457,7 +457,7 @@ spec: - name: name value: clamav-scan - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217 + value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3.1@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217 - name: kind value: task resolver: bundles @@ -485,7 +485,7 @@ spec: - name: name value: sast-shell-check-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:61b27e6ad5daba761d41bb37efb790ed98380603fd4fe2f86d156def5bd72ecc + value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:beb05ae2fad733783b3b17e05871e0eaf527a07c904cf3fb2cb551025007eec1 - name: kind value: task resolver: bundles @@ -513,7 +513,7 @@ spec: - name: name value: sast-unicode-check-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:eb9d5392f215cb8b52b16382098cac4885b1e6cd989f88ebd83fdb234d283eb9 + value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:d09f717cb84f0699a531773bc498745deef2c006a81918aa73b3be6d2f4778bd - name: kind value: task resolver: bundles @@ -535,7 +535,7 @@ spec: - name: name value: apply-tags - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:3ab844157eccd68e95e4852adc06c3c4ea674edb7865a474b0a898227f2893d6 + value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:2dae3c4beaf1070db565c536bc997e93925ae8c0c45dd8da9b4ae5293fd8c592 - name: kind value: task resolver: bundles @@ -558,7 +558,7 @@ spec: - name: name value: push-dockerfile-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:5a6cbebd89e5bc163b38231859767f7f6a0dd66cf1333699574379f062731183 + value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:393b4d0b530c2657b3ff6fec714781f4938b95b699dea2b369442b7664e1cce2 - name: kind value: task resolver: bundles @@ -575,7 +575,7 @@ spec: - name: name value: rpms-signature-scan - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cc5133504ff03909ae970db81a986cb25a5532b2faf62a8ede5c60f28b716f54 + value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2.1@sha256:538a853c4a299216c43258ccc9894215f5440dc0c70c9c99fe22fc9633a8e79d - name: kind value: task resolver: bundles diff --git a/.tekton/functions-utils-push.yaml b/.tekton/functions-utils-push.yaml index fbc5bce99b..dbc338217d 100644 --- a/.tekton/functions-utils-push.yaml +++ b/.tekton/functions-utils-push.yaml @@ -171,7 +171,7 @@ spec: - name: name value: init - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.2@sha256:421003a5c077ecb820460e71637125ec9093d2101c749a32ede28e190283e9db + value: quay.io/konflux-ci/tekton-catalog/task-init:0.4.3@sha256:5f687152ab0661f84830877de93a8ec45cb0b756f71b24ac55133d03a4007936 - name: kind value: task resolver: bundles @@ -192,7 +192,7 @@ spec: - name: name value: git-clone-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.4@sha256:df3c42d78223f07b40a84dd29e5c8860d14777ffdf150ea08c738770f51216dc + value: quay.io/konflux-ci/tekton-catalog/task-git-clone-oci-ta:0.2.6@sha256:3bcd4c39a346d29617013f4c47d245d38f020cdbf814cf3ce095911c528f5003 - name: kind value: task resolver: bundles @@ -218,7 +218,7 @@ spec: - name: name value: prefetch-dependencies-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.3.2@sha256:389aea03a065e8118d36b7acb85b05cd13f6750e7e10ff8a85f270ee65b0167b + value: quay.io/konflux-ci/tekton-catalog/task-prefetch-dependencies-oci-ta:0.10.1@sha256:c09c1c3ced67fb8740b2925a7de09c0810d4e8c8f148d41c21ffe37810d85c62 - name: kind value: task resolver: bundles @@ -282,7 +282,7 @@ spec: - name: name value: buildah-remote-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.10.5@sha256:eb277ec7b44443f0506a60ac940a2e52178d60f17cb0f51a6966daed5b3755de + value: quay.io/konflux-ci/tekton-catalog/task-buildah-remote-oci-ta:0.12.0@sha256:44c1ca2e823f006ee94e066231b033b191f0f8cee51add1e908138335eba9b30 - name: kind value: task resolver: bundles @@ -304,7 +304,7 @@ spec: - name: name value: build-image-index - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:cc75f64deecccb1b59e96ac1182665a5342d79c9e22eebff63d26b0f00a4319c + value: quay.io/konflux-ci/tekton-catalog/task-build-image-index:0.3.1@sha256:c2cda69e681c976dd5b39caf6682d1c8f8c5e5a53a67a22a5b06d4cde773bd10 - name: kind value: task resolver: bundles @@ -325,7 +325,7 @@ spec: - name: name value: source-build-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:7c5575ac8e292f27f57716c021ab0324460dc958e73946724c588c5228e5f372 + value: quay.io/konflux-ci/tekton-catalog/task-source-build-oci-ta:0.3@sha256:6bb2697f8f194a6a644b8b861489ce8b1c5ba16a7d55dbd8e66a0c98d06dfc1c - name: kind value: task resolver: bundles @@ -374,7 +374,7 @@ spec: - name: name value: clair-scan - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.3@sha256:f5b4415db9ac1fba3e11d993a617e0b275d1f0ed2fc669b12c400ed848c39174 + value: quay.io/konflux-ci/tekton-catalog/task-clair-scan:0.4.0@sha256:dcc6ca58d3ec03d05ce21c03b4f51b58cac9878caa932ad06a9fdf4bc422aaab - name: kind value: task resolver: bundles @@ -399,7 +399,7 @@ spec: - name: name value: ecosystem-cert-preflight-checks - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:42720a1e9ed1ef75b615a03e521d01e3ce7ca67c995366a374a58e1307986c58 + value: quay.io/konflux-ci/tekton-catalog/task-ecosystem-cert-preflight-checks:0.2@sha256:4619769705d4999e129b779d7699d89d33c47f7ab80d73ad6e3dcd8a6a4e43a7 - name: kind value: task resolver: bundles @@ -427,7 +427,7 @@ spec: - name: name value: sast-snyk-check-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:eba24f5d9f4b18aa71e523b9b3dbcf22982aa4b018824260a090b19dfc9abf6f + value: quay.io/konflux-ci/tekton-catalog/task-sast-snyk-check-oci-ta:0.5@sha256:b78e9c05c5126613eddee53f2f3534a9b86bfca17d903599f2fa465b7938e241 - name: kind value: task resolver: bundles @@ -454,7 +454,7 @@ spec: - name: name value: clamav-scan - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217 + value: quay.io/konflux-ci/tekton-catalog/task-clamav-scan:0.3.1@sha256:53a02326bfb930ca5ef6bfa7a33acca833d57752f34f3cb79255fe2e25e7d217 - name: kind value: task resolver: bundles @@ -482,7 +482,7 @@ spec: - name: name value: sast-shell-check-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:61b27e6ad5daba761d41bb37efb790ed98380603fd4fe2f86d156def5bd72ecc + value: quay.io/konflux-ci/tekton-catalog/task-sast-shell-check-oci-ta:0.1@sha256:beb05ae2fad733783b3b17e05871e0eaf527a07c904cf3fb2cb551025007eec1 - name: kind value: task resolver: bundles @@ -510,7 +510,7 @@ spec: - name: name value: sast-unicode-check-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:eb9d5392f215cb8b52b16382098cac4885b1e6cd989f88ebd83fdb234d283eb9 + value: quay.io/konflux-ci/tekton-catalog/task-sast-unicode-check-oci-ta:0.4@sha256:d09f717cb84f0699a531773bc498745deef2c006a81918aa73b3be6d2f4778bd - name: kind value: task resolver: bundles @@ -532,7 +532,7 @@ spec: - name: name value: apply-tags - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:3ab844157eccd68e95e4852adc06c3c4ea674edb7865a474b0a898227f2893d6 + value: quay.io/konflux-ci/tekton-catalog/task-apply-tags:0.3@sha256:2dae3c4beaf1070db565c536bc997e93925ae8c0c45dd8da9b4ae5293fd8c592 - name: kind value: task resolver: bundles @@ -555,7 +555,7 @@ spec: - name: name value: push-dockerfile-oci-ta - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:5a6cbebd89e5bc163b38231859767f7f6a0dd66cf1333699574379f062731183 + value: quay.io/konflux-ci/tekton-catalog/task-push-dockerfile-oci-ta:0.3.1@sha256:393b4d0b530c2657b3ff6fec714781f4938b95b699dea2b369442b7664e1cce2 - name: kind value: task resolver: bundles @@ -572,7 +572,7 @@ spec: - name: name value: rpms-signature-scan - name: bundle - value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2@sha256:cc5133504ff03909ae970db81a986cb25a5532b2faf62a8ede5c60f28b716f54 + value: quay.io/konflux-ci/tekton-catalog/task-rpms-signature-scan:0.2.1@sha256:538a853c4a299216c43258ccc9894215f5440dc0c70c9c99fe22fc9633a8e79d - name: kind value: task resolver: bundles From 8ea6801e174d0b6687b0013ae654cfce66d00776 Mon Sep 17 00:00:00 2001 From: "red-hat-konflux-kflux-prd-rh02[bot]" <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 08:34:32 +0000 Subject: [PATCH 31/38] Update functions-utils to 622dec2 Image created from 'https://github.com/openshift/functions?rev=7deb6aa61c203872320d2265fcbf2de263814b50' Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> --- Dockerfile.func.rhel9 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.func.rhel9 b/Dockerfile.func.rhel9 index d107028025..5e4046969a 100644 --- a/Dockerfile.func.rhel9 +++ b/Dockerfile.func.rhel9 @@ -4,7 +4,7 @@ ARG GO_RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal # Reference to the func-util image, baked into the func binary at build time # so it knows which image to use for in-cluster helper tasks (socat, tar, # deploy/scaffold/s2i pipeline steps). -ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:447c64264a98b492bfc87a399910579d8da7e87860c6c2f311ea2ec660620602 +ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:622dec27e6a6108654de84a5e3393c0833c014119e1c8865cdbc4aa3259fe6c9 FROM $GO_BUILDER as builder From d7ff7da43aebe3251eaef278c3e26e1c58f11e13 Mon Sep 17 00:00:00 2001 From: "openshift-rebasebot[bot]" <289950310+openshift-rebasebot[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 12:11:10 +0000 Subject: [PATCH 32/38] UPSTREAM: : Remove upstream-only files not used in OpenShift org --- .github/workflows/ci-check.yaml | 43 --------------------------------- 1 file changed, 43 deletions(-) delete mode 100644 .github/workflows/ci-check.yaml diff --git a/.github/workflows/ci-check.yaml b/.github/workflows/ci-check.yaml deleted file mode 100644 index 781347e155..0000000000 --- a/.github/workflows/ci-check.yaml +++ /dev/null @@ -1,43 +0,0 @@ -name: Check - -# Documentation-only companion to the Functions workflow. -# -# The Functions workflow ignores documentation changes (see its `paths-ignore`), -# so this workflow covers exactly those paths and runs only the checks that -# apply to them (`make check-docs`). The two trigger sets are disjoint: a -# doc-only change runs Check, a code change runs Functions. - -on: - push: - branches: - - main - - 'release-*' - paths: - - 'docs/**/*.md' - - '*.md' - pull_request: - branches: - - main - - 'release-*' - paths: - - 'docs/**/*.md' - - '*.md' - -permissions: - contents: read - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: ${{ github.event_name == 'pull_request' }} - -jobs: - check-docs: - name: Check Docs - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - uses: actions/checkout@v4 - - uses: knative/actions/setup-go@main - - - name: Check Docs - run: make check-docs From d58dfa155b952f2bc0da0edddfc0cefd1743712f Mon Sep 17 00:00:00 2001 From: Marek Schmidt Date: Mon, 24 Aug 2026 15:03:21 +0200 Subject: [PATCH 33/38] switch to best-practices renovate config --- renovate.json | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/renovate.json b/renovate.json index 4e6fb1e33c..df6f9b8780 100644 --- a/renovate.json +++ b/renovate.json @@ -1,10 +1,14 @@ { "extends": [ - "github>konflux-ci/mintmaker-presets:refresh-rpm-lockfiles" + "github>konflux-ci/mintmaker//config/renovate/renovate.json", + "config:best-practices" ], + "enabledManagers": ["tekton", "dockerfile", "rpm-lockfile"], "ignorePaths": [ "templates/**", - "third_party/**" + "third_party/**", + "Dockerfile.podman-next", + "Dockerfile.utils" ], "gomod": { "enabled": false From 08aeafbf0308dfaf5a4e5563d3dd1770ad2ae5d4 Mon Sep 17 00:00:00 2001 From: David Fridrich <49119790+gauron99@users.noreply.github.com> Date: Mon, 24 Aug 2026 18:47:23 +0200 Subject: [PATCH 34/38] Update OWNERS --- OWNERS | 2 -- 1 file changed, 2 deletions(-) diff --git a/OWNERS b/OWNERS index 5f8d620b84..2acb15e700 100644 --- a/OWNERS +++ b/OWNERS @@ -1,9 +1,7 @@ approvers: - gauron99 - - perdasilva - maschmid reviewers: - gauron99 - - perdasilva - maschmid From 89e9341a71f29c8e56572900d78f98104354c30c Mon Sep 17 00:00:00 2001 From: Marek Schmidt Date: Mon, 24 Aug 2026 17:45:59 +0200 Subject: [PATCH 35/38] enable source builds --- .tekton/functions-func-pull-request.yaml | 2 ++ .tekton/functions-func-push.yaml | 2 ++ .tekton/functions-utils-pull-request.yaml | 2 ++ .tekton/functions-utils-push.yaml | 2 ++ 4 files changed, 8 insertions(+) diff --git a/.tekton/functions-func-pull-request.yaml b/.tekton/functions-func-pull-request.yaml index 3858c7b675..c5c8004978 100644 --- a/.tekton/functions-func-pull-request.yaml +++ b/.tekton/functions-func-pull-request.yaml @@ -48,6 +48,8 @@ spec: value: '{"type": "gomod", "path": "."}' - name: hermetic value: "true" + - name: build-source-image + value: "true" pipelineSpec: description: | This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. diff --git a/.tekton/functions-func-push.yaml b/.tekton/functions-func-push.yaml index cbd4d9890f..423666af85 100644 --- a/.tekton/functions-func-push.yaml +++ b/.tekton/functions-func-push.yaml @@ -45,6 +45,8 @@ spec: value: '{"type": "gomod", "path": "."}' - name: hermetic value: "true" + - name: build-source-image + value: "true" pipelineSpec: description: | This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. diff --git a/.tekton/functions-utils-pull-request.yaml b/.tekton/functions-utils-pull-request.yaml index 363e81ab36..1e6fc2e62b 100644 --- a/.tekton/functions-utils-pull-request.yaml +++ b/.tekton/functions-utils-pull-request.yaml @@ -48,6 +48,8 @@ spec: value: '[{"type": "gomod", "path": "."}, {"type": "rpm"}]' - name: hermetic value: "true" + - name: build-source-image + value: "true" pipelineSpec: description: | This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. diff --git a/.tekton/functions-utils-push.yaml b/.tekton/functions-utils-push.yaml index dbc338217d..0336ce8552 100644 --- a/.tekton/functions-utils-push.yaml +++ b/.tekton/functions-utils-push.yaml @@ -45,6 +45,8 @@ spec: value: '[{"type": "gomod", "path": "."}, {"type": "rpm"}]' - name: hermetic value: "true" + - name: build-source-image + value: "true" pipelineSpec: description: | This pipeline is ideal for building multi-arch container images from a Containerfile while maintaining trust after pipeline customization. From f7d721432758a9e942da4b049d7ecd70aa617aa2 Mon Sep 17 00:00:00 2001 From: "red-hat-konflux-kflux-prd-rh02[bot]" <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> Date: Mon, 24 Aug 2026 17:18:07 +0000 Subject: [PATCH 36/38] Update functions-utils to 689fdfe Image created from 'https://github.com/openshift/functions?rev=1bdf89b1ec5c318cab9835839bfef9f2cc13df5a' Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> --- Dockerfile.func.rhel9 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.func.rhel9 b/Dockerfile.func.rhel9 index 5e4046969a..602f180b82 100644 --- a/Dockerfile.func.rhel9 +++ b/Dockerfile.func.rhel9 @@ -4,7 +4,7 @@ ARG GO_RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal # Reference to the func-util image, baked into the func binary at build time # so it knows which image to use for in-cluster helper tasks (socat, tar, # deploy/scaffold/s2i pipeline steps). -ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:622dec27e6a6108654de84a5e3393c0833c014119e1c8865cdbc4aa3259fe6c9 +ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:689fdfe45e7062f09f4d149235fee25960083d818623bbc3afd25a50b03bc5fb FROM $GO_BUILDER as builder From 0952c07f816be765195c732707ed071dd5e269b8 Mon Sep 17 00:00:00 2001 From: "red-hat-konflux-kflux-prd-rh02[bot]" <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> Date: Tue, 25 Aug 2026 15:40:57 +0000 Subject: [PATCH 37/38] Update functions-utils to c5b2898 Image created from 'https://github.com/openshift/functions?rev=ac2363ba49eb0bdebf38ffe727160608349744cd' Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> --- Dockerfile.func.rhel9 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile.func.rhel9 b/Dockerfile.func.rhel9 index 602f180b82..b7a24de1a3 100644 --- a/Dockerfile.func.rhel9 +++ b/Dockerfile.func.rhel9 @@ -4,7 +4,7 @@ ARG GO_RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal # Reference to the func-util image, baked into the func binary at build time # so it knows which image to use for in-cluster helper tasks (socat, tar, # deploy/scaffold/s2i pipeline steps). -ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:689fdfe45e7062f09f4d149235fee25960083d818623bbc3afd25a50b03bc5fb +ARG FUNC_UTILS_IMG=quay.io/redhat-user-workloads/ocp-serverless-tenant/functions-utils@sha256:c5b289838b3ab03826517c1b5d71b0292093f77598c96a86837f5b07862b4aa2 FROM $GO_BUILDER as builder From c4a7f5ffdb77fc79fc46800a1b87b6c9b40009dc Mon Sep 17 00:00:00 2001 From: "red-hat-konflux-kflux-prd-rh02[bot]" <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> Date: Fri, 28 Aug 2026 00:03:53 +0000 Subject: [PATCH 38/38] Pin dependencies Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com> --- Dockerfile.func.rhel9 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile.func.rhel9 b/Dockerfile.func.rhel9 index b7a24de1a3..05babc8749 100644 --- a/Dockerfile.func.rhel9 +++ b/Dockerfile.func.rhel9 @@ -1,5 +1,5 @@ -ARG GO_BUILDER=registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.26-openshift-5.0 -ARG GO_RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal +ARG GO_BUILDER=registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.26-openshift-5.0@sha256:5dbd422e9634c50c52f2801def5b1d5d35a53bf56a1090a37cde057792908a0b +ARG GO_RUNTIME=registry.access.redhat.com/ubi9/ubi-minimal@sha256:580752f96d36c4132bffd30f9c34865bf4bd87f6aa161c969d117f21732e50f7 # Reference to the func-util image, baked into the func binary at build time # so it knows which image to use for in-cluster helper tasks (socat, tar,